pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/<path:filename> is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception (for example by requesting a non-existent template) and receive internal stack traces in the HTTP response. This vulnerability is fixed in 0.5.0b3.dev100.

Affected: PyPI: pyload-ng

### Summary `pyload-ng` WebUI returns full Python traceback details to clients on unhandled exceptions.

Because `/web/<path:filename>` is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception (for example by requesting a non-existent template) and receive internal stack traces in the HTTP response.

### Details The issue is caused by the combination of:

1. Unauthenticated template-render route: - `src/pyload/webui/app/blueprints/app_blueprint.py:32-36` - `@bp.route("/web/<path:filename>", endpoint="web")` - `data = render_template(filename)` with user-controlled `filename` - no `@login_required(...)` on this route

2. Global exception handler exposes traceback to response: - `src/pyload/webui/app/handlers.py:14-27` - `tb = traceback.format_exc()` - `messages.extend(tb.split('\n'))` - returned in rendered error page for all exceptions

3. Error page renders all `messages`: - `src/pyload/webui/app/themes/modern/templates/base.html:217-219` - loops over `messages` and prints them in response HTML

So any unhandled exception can disclose internal implementation details (stack frames, source paths, exception metadata) to remote unauthenticated clients.

This is a core behavior issue in default WebUI error handling

### PoC ```python #!/usr/bin/env python3 from __future__ import annotations

import re import shutil import tempfile import traceback from pathlib import Path…

Affected: PyPI: pyload-ng

### Summary `pyload-ng` WebUI returns full Python traceback details to clients on unhandled exceptions.

Because `/web/<path:filename>` is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception (for example by requesting a non-existent template) and receive internal stack traces in the HTTP response.

### Details The issue is caused by the combination of:

1. Unauthenticated template-render route: - `src/pyload/webui/app/blueprints/app_blueprint.py:32-36` - `@bp.route("/web/<path:filename>", endpoint="web")` - `data = render_template(filename)` with user-controlled `filename` - no `@login_required(...)` on this route

2. Global exception handler exposes traceback to response: - `src/pyload/webui/app/handlers.py:14-27` - `tb = traceback.format_exc()` - `messages.extend(tb.split('\n'))` - returned in rendered error page for all exceptions

3. Error page renders all `messages`: - `src/pyload/webui/app/themes/modern/templates/base.html:217-219` - loops over `messages` and prints them in response HTML

So any unhandled exception can disclose internal implementation details (stack frames, source paths, exception metadata) to remote unauthenticated clients.

This is a core behavior issue in default WebUI error handling

### PoC ```python #!/usr/bin/env python3 from __future__ import annotations

import re import shutil import tempfile import traceback from pathlib import Path…