Vulnerability-Lookup

CVE-2026-75597 (GCVE-0-2026-75597)

Vulnerability from cvelistv5 – Published: 2026-10-09 16:41 – Updated: 2026-10-09 17:04

Title

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

Summary

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-09 17:03 UTC

CWE

CWE-209 - Generation of Error Message Containing Sensitive Information
CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7615 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/pyload/pyload/security/advisor…	x_refsource_CONFIRM
https://github.com/pyload/pyload/commit/e80c940cd…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
pyload	pyload	Affected: < 0.5.0b3.dev101	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75597",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T17:03:11.642795Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T17:04:31.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pyload",
          "vendor": "pyload",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.0b3.dev101"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/\u003cpath:filename\u003e` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T16:41:21.081Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx"
        },
        {
          "name": "https://github.com/pyload/pyload/commit/e80c940cd604e60d93e3164429d4fc4aac54468d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyload/pyload/commit/e80c940cd604e60d93e3164429d4fc4aac54468d"
        }
      ],
      "source": {
        "advisory": "GHSA-j92p-c242-7hfx",
        "discovery": "UNKNOWN"
      },
      "title": "pyLoad: Unauthenticated access to /web/\u003cpath:filename\u003e bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-75597",
    "datePublished": "2026-10-09T16:41:21.081Z",
    "dateReserved": "2026-08-17T23:49:03.449Z",
    "dateUpdated": "2026-10-09T17:04:31.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-75597",
      "date": "2026-10-10",
      "epss": "0.00296",
      "percentile": "0.20475"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "pyload",
                "vendor": "pyload",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 0.5.0b3.dev101"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/\u003cpath:filename\u003e` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch."
          }
        ],
        "id": "CVE-2026-75597",
        "lastModified": "2026-10-09T18:17:14.173",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-75597",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T17:03:11.642795Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-09T17:16:48.550",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pyload/pyload/commit/e80c940cd604e60d93e3164429d4fc4aac54468d"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-209"
              },
              {
                "lang": "en",
                "value": "CWE-306"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-75597",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-09T17:03:11.642795Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-09T17:04:15.720Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "pyload",
              "vendor": "pyload",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 0.5.0b3.dev101"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/\u003cpath:filename\u003e` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-209",
                  "description": "CWE-209: Generation of Error Message Containing Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306: Missing Authentication for Critical Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-09T16:41:21.081Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx"
            },
            {
              "name": "https://github.com/pyload/pyload/commit/e80c940cd604e60d93e3164429d4fc4aac54468d",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pyload/pyload/commit/e80c940cd604e60d93e3164429d4fc4aac54468d"
            }
          ],
          "source": {
            "advisory": "GHSA-j92p-c242-7hfx",
            "discovery": "UNKNOWN"
          },
          "title": "pyLoad: Unauthenticated access to /web/\u003cpath:filename\u003e bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-75597",
        "datePublished": "2026-10-09T16:41:21.081Z",
        "dateReserved": "2026-08-17T23:49:03.449Z",
        "dateUpdated": "2026-10-09T17:04:31.503Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-75597

Vulnerability from fkie_nvd - Published: 2026-10-09 17:16 - Updated: 2026-10-09 18:17

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/pyload/pyload/commit/e80c940cd604e60d93e3164429d4fc4aac54468d
	security-advisories@github.com	https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "pyload",
          "vendor": "pyload",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.0b3.dev101"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/\u003cpath:filename\u003e` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch."
    }
  ],
  "id": "CVE-2026-75597",
  "lastModified": "2026-10-09T18:17:14.173",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-75597",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-09T17:03:11.642795Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-09T17:16:48.550",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pyload/pyload/commit/e80c940cd604e60d93e3164429d4fc4aac54468d"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-209"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-J92P-C242-7HFX

Vulnerability from github – Published: 2026-10-09 16:40 – Updated: 2026-10-09 16:40

Summary

pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

Details

Summary

The /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is protected by @login_required, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in src/pyload/webui/app/handlers.py (exc.desc instead of exc.description), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation.

Details

Bug 1 — Missing authentication on /web/<path:filename>

File: src/pyload/webui/app/blueprints/app_blueprint.py, lines 32–36

@bp.route("/web/<path:filename>", endpoint="web")
def render(filename):                          # ← no @login_required
    mimetype = mimetypes.guess_type(filename)[0] or "text/html"
    data = render_template(filename)
    return flask.Response(data, mimetype=mimetype)

Every other sensitive route in the same file is protected:

@bp.route("/logs", ...)
@login_required("LIST")       # protected

@bp.route("/settings", ...)
@login_required("SETTINGS")  # protected

@bp.route("/files", ...)
@login_required("DOWNLOAD")  # protected

The /web/<path:filename> route has no such decorator, allowing any unauthenticated HTTP client to render arbitrary templates by supplying their filename in the URL path.

Bug 2 — Exception attribute typo causes internal details in error responses

File: src/pyload/webui/app/handlers.py, lines 12–20

def handle_exception_error(exc):
    try:
        code = exc.code
        desc = exc.desc          # BUG: attribute does not exist on standard exceptions
    except AttributeError:       # always raised — falls here for every exception
        code = 500
        desc = exc               # raw exception object assigned to desc
    message = f"Error {code}: {desc}"   # str(exc) embedded in response body
    return render_template("error.html", messages=[message]), code

exc.desc does not exist on standard Python or Jinja2 exceptions. The AttributeError branch is always taken for template rendering failures. desc is set to the raw exception object, and str(exc) is embedded in the HTML response body returned to the unauthenticated caller. For a UndefinedError this produces 'conf' is undefined. For TemplateNotFound it produces the template filename.

PoC

Tested against pyload-ng develop branch (0.5.0b3.dev), default install, no authentication cookies or credentials used in any request.

Test 1 — Unauthenticated page render confirmed (HTTP 200)

curl -si http://TARGET:8000/web/logs.html | grep "HTTP\|title"

Test 2 — System info page with sensitive field labels rendered unauthenticated ```curl -s http://TARGET:8000/web/info.html | grep "Python Version|Installation Folder|Config Folder|OS Platform" html

Python Version: OS Platform: Installation Folder: Config Folder:

```

Test 3 — Internal Jinja2 variable name leaked in HTTP 500 body (unauthenticated) ```curl -si http://TARGET:8000/web/settings.html | grep "HTTP|Error" HTTP/1.1 500 INTERNAL SERVER ERROR

Error 500: 'conf' is undefined

Test 4 — Template enumeration via response code differentiationcurl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/logs.html curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/info.html curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/dashboard.html curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/settings.html curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/queue.html curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/collector.html curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/filemanager.html curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/nonexistent_xyz.html 200 ← logs.html (exists, renders without auth) 200 ← info.html (exists, renders without auth) 200 ← dashboard.html (exists, renders without auth) 500 ← settings.html (exists, missing auth context — leaks 'conf' is undefined) 500 ← queue.html (exists, missing auth context) 500 ← collector.html (exists, missing auth context) 500 ← filemanager.html (exists, missing auth context) 500 ← nonexistent_xyz (does not exist — same 500, no differentiation on miss)```

Impact

An unauthenticated remote attacker can:

Render application page templates without any credentials, bypassing the access control model enforced on all direct routes Access the system information page (info.html) exposing field structure for Python version, OS platform, pyLoad version, installation folder, config folder, and WebUI port — values are populated via JS but field labels confirm application structure Access the full log viewer UI (logs.html) and download dashboard (dashboard.html) without authentication Extract internal Jinja2 template variable names from HTTP 500 response bodies ('conf' is undefined, etc.) Enumerate all valid template filenames by observing 200 vs 500 response codes

The access control inconsistency is the core issue: the authentication model enforced on direct routes is completely bypassed via the /web/ endpoint. Any future template that renders sensitive data server-side would be immediately exposed to unauthenticated access through this route.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.0b3.dev100"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "pyload-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.0b3.dev101"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-75597"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-09T16:40:30Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe `/web/\u003cpath:filename\u003e` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation.\n\n### Details\n\n**Bug 1 \u2014 Missing authentication on `/web/\u003cpath:filename\u003e`**\n\nFile: `src/pyload/webui/app/blueprints/app_blueprint.py`, lines 32\u201336\n\n```python\n@bp.route(\"/web/\u003cpath:filename\u003e\", endpoint=\"web\")\ndef render(filename):                          # \u2190 no @login_required\n    mimetype = mimetypes.guess_type(filename)[0] or \"text/html\"\n    data = render_template(filename)\n    return flask.Response(data, mimetype=mimetype)\n```\n\nEvery other sensitive route in the same file is protected:\n\n```python\n@bp.route(\"/logs\", ...)\n@login_required(\"LIST\")       # protected\n\n@bp.route(\"/settings\", ...)\n@login_required(\"SETTINGS\")  # protected\n\n@bp.route(\"/files\", ...)\n@login_required(\"DOWNLOAD\")  # protected\n```\n\nThe `/web/\u003cpath:filename\u003e` route has no such decorator, allowing any unauthenticated HTTP client to render arbitrary templates by supplying their filename in the URL path.\n\n**Bug 2 \u2014 Exception attribute typo causes internal details in error responses**\n\nFile: `src/pyload/webui/app/handlers.py`, lines 12\u201320\n\n```python\ndef handle_exception_error(exc):\n    try:\n        code = exc.code\n        desc = exc.desc          # BUG: attribute does not exist on standard exceptions\n    except AttributeError:       # always raised \u2014 falls here for every exception\n        code = 500\n        desc = exc               # raw exception object assigned to desc\n    message = f\"Error {code}: {desc}\"   # str(exc) embedded in response body\n    return render_template(\"error.html\", messages=[message]), code\n```\n\n`exc.desc` does not exist on standard Python or Jinja2 exceptions. The `AttributeError` branch is always taken for template rendering failures. `desc` is set to the raw exception object, and `str(exc)` is embedded in the HTML response body returned to the unauthenticated caller. For a `UndefinedError` this produces `\u0027conf\u0027 is undefined`. For `TemplateNotFound` it produces the template filename.\n\n### PoC\n\nTested against pyload-ng develop branch (`0.5.0b3.dev`), default install, no authentication cookies or credentials used in any request.\n\n**Test 1 \u2014 Unauthenticated page render confirmed (HTTP 200)**\n```bash\ncurl -si http://TARGET:8000/web/logs.html | grep \"HTTP\\|title\"\n\n```\n\nTest 2 \u2014 System info page with sensitive field labels rendered unauthenticated\n```curl -s http://TARGET:8000/web/info.html | grep \"Python Version\\|Installation Folder\\|Config Folder\\|OS Platform\"\nhtml\n\n\u003cdt\u003e\u003cb\u003ePython Version:\u003c/b\u003e\u003c/dt\u003e\n\u003cdt\u003e\u003cb\u003eOS Platform:\u003c/b\u003e\u003c/dt\u003e\n\u003cdt\u003e\u003cb\u003eInstallation Folder:\u003c/b\u003e\u003c/dt\u003e\n\u003cdt\u003e\u003cb\u003eConfig Folder:\u003c/b\u003e\u003c/dt\u003e```\n\nTest 3 \u2014 Internal Jinja2 variable name leaked in HTTP 500 body (unauthenticated)\n```curl -si http://TARGET:8000/web/settings.html | grep \"HTTP\\|Error\"\nHTTP/1.1 500 INTERNAL SERVER ERROR\n\u003cp\u003e\u003cb\u003eError 500: \u0027conf\u0027 is undefined\u003c/b\u003e\u003c/p\u003e```\nTest 4 \u2014 Template enumeration via response code differentiation\n```curl -o /dev/null -sw \"%{http_code}\\n\" http://TARGET:8000/web/logs.html\ncurl -o /dev/null -sw \"%{http_code}\\n\" http://TARGET:8000/web/info.html\ncurl -o /dev/null -sw \"%{http_code}\\n\" http://TARGET:8000/web/dashboard.html\ncurl -o /dev/null -sw \"%{http_code}\\n\" http://TARGET:8000/web/settings.html\ncurl -o /dev/null -sw \"%{http_code}\\n\" http://TARGET:8000/web/queue.html\ncurl -o /dev/null -sw \"%{http_code}\\n\" http://TARGET:8000/web/collector.html\ncurl -o /dev/null -sw \"%{http_code}\\n\" http://TARGET:8000/web/filemanager.html\ncurl -o /dev/null -sw \"%{http_code}\\n\" http://TARGET:8000/web/nonexistent_xyz.html\n200  \u2190 logs.html        (exists, renders without auth)\n200  \u2190 info.html        (exists, renders without auth)\n200  \u2190 dashboard.html   (exists, renders without auth)\n500  \u2190 settings.html    (exists, missing auth context \u2014 leaks \u0027conf\u0027 is undefined)\n500  \u2190 queue.html       (exists, missing auth context)\n500  \u2190 collector.html   (exists, missing auth context)\n500  \u2190 filemanager.html (exists, missing auth context)\n500  \u2190 nonexistent_xyz  (does not exist \u2014 same 500, no differentiation on miss)```\n\n###Impact\nAn unauthenticated remote attacker can:\n\nRender application page templates without any credentials, bypassing the access control model enforced on all direct routes\nAccess the system information page (info.html) exposing field structure for Python version, OS platform, pyLoad version, installation folder, config folder, and WebUI port \u2014 values are populated via JS but field labels confirm application structure\nAccess the full log viewer UI (logs.html) and download dashboard (dashboard.html) without authentication\nExtract internal Jinja2 template variable names from HTTP 500 response bodies (\u0027conf\u0027 is undefined, etc.)\nEnumerate all valid template filenames by observing 200 vs 500 response codes\n\nThe access control inconsistency is the core issue: the authentication model enforced on direct routes is completely bypassed via the /web/\u003cpath:filename\u003e endpoint. Any future template that renders sensitive data server-side would be immediately exposed to unauthenticated access through this route.",
  "id": "GHSA-j92p-c242-7hfx",
  "modified": "2026-10-09T16:40:30Z",
  "published": "2026-10-09T16:40:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/security/advisories/GHSA-j92p-c242-7hfx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pyload/pyload/commit/e80c940cd604e60d93e3164429d4fc4aac54468d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pyload/pyload"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "pyLoad: Unauthenticated access to /web/\u003cpath:filename\u003e bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-75597 (GCVE-0-2026-75597)

FKIE_CVE-2026-75597

GHSA-J92P-C242-7HFX

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour