Pyload ng: pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo (CVE-2026-75597)

The /web/<path:filename> route in pyLoad-ng's web UI lacks authentication protection, unlike other sensitive routes protected by @login_required decorators. This allows unauthenticated users to render arbitrary templates by specifying their filename in the URL path. Furthermore, an exception attribute typo in the error handler causes internal exception details to be leaked in HTTP 500 responses. Specifically, the handler incorrectly references exc.desc instead of exc.description, causing the raw exception string (e.g., 'conf' is undefined) to be included in the error page. This combination allows unauthenticated attackers to bypass access controls, view sensitive system information pages, and enumerate valid template names by observing HTTP response codes.

An unauthenticated remote attacker can bypass authentication controls to render sensitive application templates, including system information pages revealing Python version, OS platform, installation and config folder paths, and WebUI port. The attacker can also enumerate valid template names by differentiating HTTP 200 and 500 responses. Internal Jinja2 variable names and error details are leaked in HTTP 500 responses, potentially aiding further reconnaissance. There is no indication of direct code execution or data modification from this vulnerability.

A patch is available for this vulnerability. Users should upgrade to pyLoad-ng version 0.5.0b3.dev101 or later, where the /web/<path:filename> route is protected by authentication and the exception handling bug is fixed. Until patched, restrict access to the web UI to trusted networks or users to mitigate unauthorized template rendering and information leakage.