CVE-2026-75597Medium· 5.3▾ TwilightPoC availablepyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyload/webui/app/blueprints/app_blueprint.py` renders Jinja2 templates without any authentication requ…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Exploit / PoC code exists
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/<path:filename> route in src/pyload/webui/app/blueprints/app_blueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route (/logs, /settings, /queue, /dashboard, etc.) is protected by @login_required, but the underlying templates for all of these pages are accessible unauthenticated via this endpoint. Combined with an exception attribute typo in src/pyload/webui/app/handlers.py (exc.desc instead of exc.description), internal Jinja2 variable names are leaked in HTTP 500 response bodies to unauthenticated callers. An attacker can also enumerate all valid template names by observing 200 vs 500 response differentiation. Version 0.5.0b3.dev101 contains a patch.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
pyload-ng <= 0.5.0b3.dev100Patched in:
pyload-ng 0.5.0b3.dev101Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48484Medium· 6.5pyLoad is a free and open-source download manager written in Python
CVE-2026-40071Medium· 5.4pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
CVE-2025-53890Critical· 9.8pyLoad vulnerable to XSS through insecure CAPTCHA
CVE-2024-32880Critical· 9.1pyLoad allows upload to arbitrary folder lead to RCE
CVE-2024-22416Critical· 9.6Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
CVE-2024-21644High· 7.5pyload Unauthenticated Flask Configuration Leakage vulnerability