CVE-2026-75597

The pyLoad download manager is vulnerable to unauthenticated access to sensitive Jinja2 templates. Prior to version 0.5.0b3.dev101 , the /web/ route in src/pyload/webui/app/blueprints/app_blueprint.py fails to enforce authentication, bypassing the @login_required protection used on direct routes ...

CVE-2026-75597 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...