CVE-2026-75597: pyLoad Unauthenticated Access to Sensitive Templates and Internal Error Details Leakage
Summary
CVE-2026-75597: The /web/ route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Affects pyload-ng versions < 0.5.0b3.dev101. Fixed in 0.5.0b3.dev101. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyLoad is an open-source download manager that allows users to manage and automate the downloading of files from various sources. It provides a web interface for users to interact with the application, offering features such as a queue manager, log viewer, and settings configuration. However, a significant vulnerability has been identified that allows unauthenticated access to sensitive templates, potentially exposing internal application details.
Vulnerability Detail
The vulnerability arises from the lack of authentication on the '/web/path:filename' route in the pyLoad application. This route allows any unauthenticated user to render Jinja2 templates without any access control, bypassing the protections in place for other sensitive routes. Additionally, an exception handling bug leads to the leakage of internal variable names in HTTP 500 error responses. This can allow attackers to enumerate valid template names and gain insights into the application's structure and sensitive information.
How To Fix
Latest published version: 0.5.0b3.dev101 as of 23 Oct 2026
pip install --upgrade "pyload-ng==0.5.0b3.dev101"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the application by implementing network-level controls, such as firewalls or VPNs, to limit who can access the pyLoad web interface until the package is updated.
Conclusion
The CVE-2026-75597 vulnerability in pyLoad poses a significant risk by allowing unauthenticated access to sensitive templates and leaking internal error details. It is crucial for users to update to the patched version to mitigate these risks and protect their applications.
See every vulnerability recorded for pyload-ng →
FAQ
CVE-2026-75597 is a vulnerability in the pyLoad application that allows unauthenticated access to sensitive templates and leaks internal error details.
This vulnerability can allow unauthorized users to access sensitive information and internal application details, potentially leading to further exploitation.
Versions of pyLoad up to 0.5.0b3.dev100 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyload-ng.
