- A GitHub advisory reports that pyLoad's /web/<path:filename> route renders page templates without requiring login, and that a typo exposes internal error details.
- The researchers tested the develop branch (0.5.0b3.dev). The advisory does not say how released versions are affected.
- Teams running pyLoad should confirm it is not reachable from untrusted networks and ask which version they run.
The door nobody locked
Picture an office where every room has a keycard reader. Then someone adds a side corridor that opens into the same rooms and forgets the reader. The locks work. The building is still open.
That is the shape of a flaw reported in pyLoad, an open-source download manager with a web interface. The GitHub Advisory Database published the report on October 9, 2026. It describes how one route skipped the login check that protects the rest of the application.
What the advisory reports
The route is /web/<path:filename>, in the file app_blueprint.py. It renders the Jinja2 templates behind screens such as logs, settings, queue and dashboard. The advisory says each of those screens has its own direct route protected by a @login_required rule. The /web route has no such rule.
So an unauthenticated visitor can ask for a template by putting its filename in the URL. The advisory says the tests used no authentication cookies or credentials.
How a typo turns an error into a leak
The second problem sits in handlers.py, the code that builds error pages. It reads an attribute called exc.desc. The correct name is exc.description. The wrong name does not exist, so the code takes its fallback path.
That fallback puts the raw error text into the page returned to the caller. For a missing variable, the page says 'conf' is undefined. For a missing template, it prints the template's filename. The advisory says this leaks internal Jinja2 variable names to unauthenticated callers.
The advisory adds a third effect. An attacker can enumerate valid template names by observing the difference between 200 and 500 responses.
What is and is not shown
The limits matter here. The researchers tested the develop branch, version 0.5.0b3.dev, on a default install. The advisory text does not say which released versions are affected. It does not give a CVE ID, a severity score or a fix.
It also does not claim that stored data was exposed. It reports that a system information page rendered, with sensitive field labels, to an unauthenticated caller. The advisory does not say what values those fields held.
The lesson: protection that must be remembered will be forgotten
This shows a design choice more than a coding mistake. When each route must opt in to authentication, safety depends on every developer remembering every time. One missed line leaves one open path. Reviewers who check the routes people use daily can overlook a generic one.
The safer design reverses the default. Every route requires login unless someone deliberately marks it public. Then a forgotten decorator produces a locked page, not an open one.
The typo teaches a second point. Error handling is part of the attack surface. A message written to help a developer debug can read, to a stranger, like a guided tour.
What to ask your team
First, does anyone run pyLoad, and in which version? Download tools can sit on a spare server and escape inventory.
Second, is its web interface reachable from the internet or from untrusted networks? If so, restrict it to a VPN or an allow-list while you wait for guidance from the project.
Third, for software you build or buy, ask whether access control is applied by default or added route by route. Ask also whether error pages show internal text to anonymous users. These questions target the two weaknesses reported here.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: GitHub Advisory Database.
