Is CVE-2026-75597 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75597 being exploited in the wild.

How severe is CVE-2026-75597?

Medium severity, with a CVSS score of 5.3, published 9 October 2026.

Which products and versions are affected?

pyLoad 0.5.0b3.dev and likely others; pyload-ng (PyPI) <= 0.5.0b3.dev100, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev101.

How is CVE-2026-75597 attacked?

It is attacked over the network.

Am I affected by CVE-2026-75597?

Check whether you run pyLoad or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75597: pyLoad unauthenticated template access and information disclosure

Q: Is there a fix for CVE-2026-75597?

Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev101 or later. Until then: Restrict access to the `/web/` endpoint at the reverse proxy or firewall level, or disable the pyLoad web interface if it is not required. Apply authentication checks to the `/web/ ` route by adding the `@login_required` decorator. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-75597 · Severity: medium · CVSS 5.3 · Published 2026-10-09

pyLoad is a download manager with a web interface that enforces authentication on its pages. A vulnerability allows attackers to bypass authentication and directly access sensitive page templates through an unprotected endpoint, potentially exposing system information like Python version and installation paths. Additionally, when templates fail to render, internal error details are leaked in HTTP responses to unauthenticated users.

Technologies: pyLoad, pyload-ng (PyPI). Vendors: pyLoad, PyPI.

Quick answers

Is CVE-2026-75597 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75597 being exploited in the wild.
How severe is CVE-2026-75597?: Medium severity, with a CVSS score of 5.3, published 9 October 2026.
Which products and versions are affected?: pyLoad 0.5.0b3.dev and likely others; pyload-ng (PyPI) <= 0.5.0b3.dev100, ECOSYSTEM:introduced=0,fixed=0.5.0b3.dev101.
Is there a fix for CVE-2026-75597?: Yes. pyload-ng (PyPI): upgrade to 0.5.0b3.dev101 or later. Until then: Restrict access to the `/web/` endpoint at the reverse proxy or firewall level, or disable the pyLoad web interface if it is not required. Apply authentication checks to the `/web/<path:filename>` route by adding the `@login_required` decorator. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75597 attacked?: It is attacked over the network.
Am I affected by CVE-2026-75597?: Check whether you run pyLoad or pyload-ng (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pyload-ng (PyPI): upgrade to 0.5.0b3.dev101 or later
```
pip install "pyload-ng>=0.5.0b3.dev101"
```

Restrict access to the `/web/` endpoint at the reverse proxy or firewall level, or disable the pyLoad web interface if it is not required. Apply authentication checks to the `/web/<path:filename>` route by adding the `@login_required` decorator.

Technical details

The `/web/<path:filename>` route in pyLoad's Flask application renders Jinja2 templates without the `@login_required` decorator present on all other sensitive routes, enabling unauthenticated template access. Combined with an exception handler typo (`exc.desc` instead of `exc.description`), template rendering failures return raw exception objects in error messages, leaking internal Jinja2 variable names to unauthenticated callers. Attackers can also enumerate valid template filenames by observing HTTP 200 versus 500 response codes.

Affected products

pyLoad pyLoad 0.5.0b3.dev and likely others

Identifiers

CVE-2026-75597
GHSA-j92p-c242-7hfx
PYSEC-2026-4292

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.