TI-2026-70042 Aliases CVE-2026-75597 GHSA-j92p-c242-7hfx

Missing authentication in pyLoad exposes templates and error details

MEDIUM 63CWE-209Published 2026-10-09 · Updated 2026-10-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-209 and CWE-306.

Summary

pyLoad is affected before 0.5.0b3.dev101, including the pyload-ng package on PyPI from 0 before 0.5.0b3.dev101. The /web/<path:filename> route renders Jinja2 templates without authentication, exposing pages that other routes protect with login (CWE-306). A typo in exception handling leaks internal template variable names in HTTP 500 responses (CWE-209). An unauthenticated remote attacker can read these templates and enumerate valid names by comparing 200 and 500 responses.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00296 22nd percentileScored 2026-11-07

Fix Fixed pyload (pyload): 0.5.0b3.dev101pyload-ng (PyPI): 0.5.0b3.dev101

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pyload	pyload	before 0.5.0b3.dev101	0.5.0b3.dev101	Patch available	CNA
—	pyload-ng (PyPI)	before 0.5.0b3.dev101	0.5.0b3.dev101	Patch available	GHSA-j92p-c242-7hfx

pyload Vendorpyload Affected before 0.5.0b3.dev101 Fixed in 0.5.0b3.dev101 Patch available CNA
pyload-ng (PyPI) Vendor— Affected before 0.5.0b3.dev101 Fixed in 0.5.0b3.dev101 Patch available GHSA-j92p-c242-7hfx

Remediation

Upgrade pyload-ng to 0.5.0b3.dev101, which contains the patch. The sources list no fixed version for pyload.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA pyload (pyload) Fixed in 0.5.0b3.dev101
Fix · GHSA-j92p-c242-7hfx pyload-ng (PyPI) Fixed in 0.5.0b3.dev101 Advisory →

Timeline

2026-10-09 Threatist record created from CVE-2026-75597
2026-10-09 Alias added: GHSA-j92p-c242-7hfx

References

Other 3

TI-2023-00282 Code Injection in pyload/pyload CVSS 3.1CRITICAL 9.8
TI-2025-34556 pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
TI-2025-33765 pyLoad vulnerable to remote code execution through js2py onCaptchaResult CVSS 3.1CRITICAL 9.8
TI-2023-00412 Excessive Attack Surface in pyload/pyload CVSS 3.1CRITICAL 9.8
TI-2026-27589 pyLoad has SSRF fix bypass via HTTP redirect CVSS 4.0CRITICAL 9.3
TI-2026-26332 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration CVSS 4.0CRITICAL 9.3

See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences