CVE-2026-75597 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
Unauthenticated attackers can access sensitive web templates and leak internal error details in pyLoad due to missing authentication checks on a specific route.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75597?
CVE-2026-75597 is a medium-severity missing authorization vulnerability in pyload, published on 9 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requirement. Every equivalent direct route (`/logs`, `/settings`, `/queue`, `/dashboard`, etc.) is protected by `@login_required`, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in `src/pyload/webui/app/handlers.py` (`exc.desc` instead of `exc.description`), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.
Which versions are affected by CVE-2026-75597?
3 open source packages ship an affected version, including pyload-ng.
| Package | Affected | Fixed in |
|---|---|---|
pyload-ng PyPI | All versions | 0.5.0b3.dev101 |
pyload-ng PyPI | All versions | 0.5.0b3.dev101 |
pyload-ng PyPI | All versions | 0.5.0b3.dev101 |
How do I fix CVE-2026-75597?
Upgrade pyload-ng to 0.5.0b3.dev101 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-75597 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75597 exists.
Sources
Also known as GHSA-j92p-c242-7hfx, PYSEC-2026-4292.