https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 20:45:37 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44226 <p><strong>Affected:</strong> pyload</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/&lt;path:filename&gt; is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception (for example by requesting a non-existent template) and receive internal stack traces in the HTTP response. This vulnerability is fixed in 0.5.0b3.dev100.</p> <p><strong>Affected:</strong> pyload</p> <p>pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/&lt;path:filename&gt; is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception (for example by requesting a non-existent template) and receive internal stack traces in the HTTP response. This vulnerability is fixed in 0.5.0b3.dev100.</p> https://cve.radiocsirt.org/vuln/cve-2026-44226 https://cve.radiocsirt.org/vuln/ghsa-c3gc-9pf2-84gg <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>### Summary `pyload-ng` WebUI returns full Python traceback details to clients on unhandled exceptions.</p> <p>Because `/web/&lt;path:filename&gt;` is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception (for example by requesting a non-existent template) and receive internal stack traces in the HTTP response.</p> <p>### Details The issue is caused by the combination of:</p> <p>1. Unauthenticated template-render route: - `src/pyload/webui/app/blueprints/app_blueprint.py:32-36` - `@bp.route(&#34;/web/&lt;path:filename&gt;&#34;, endpoint=&#34;web&#34;)` - `data = render_template(filename)` with user-controlled `filename` - no `@login_required(...)` on this route</p> <p>2. Global exception handler exposes traceback to response: - `src/pyload/webui/app/handlers.py:14-27` - `tb = traceback.format_exc()` - `messages.extend(tb.split(&#39;\n&#39;))` - returned in rendered error page for all exceptions</p> <p>3. Error page renders all `messages`: - `src/pyload/webui/app/themes/modern/templates/base.html:217-219` - loops over `messages` and prints them in response HTML</p> <p>So any unhandled exception can disclose internal implementation details (stack frames, source paths, exception metadata) to remote unauthenticated clients.</p> <p>This is a core behavior issue in default WebUI error handling</p> <p>### PoC ```python #!/usr/bin/env python3 from __future__ import annotations</p> <p>import re import shutil import tempfile import traceback from pathlib import Path…</p> <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>### Summary `pyload-ng` WebUI returns full Python traceback details to clients on unhandled exceptions.</p> <p>Because `/web/&lt;path:filename&gt;` is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception (for example by requesting a non-existent template) and receive internal stack traces in the HTTP response.</p> <p>### Details The issue is caused by the combination of:</p> <p>1. Unauthenticated template-render route: - `src/pyload/webui/app/blueprints/app_blueprint.py:32-36` - `@bp.route(&#34;/web/&lt;path:filename&gt;&#34;, endpoint=&#34;web&#34;)` - `data = render_template(filename)` with user-controlled `filename` - no `@login_required(...)` on this route</p> <p>2. Global exception handler exposes traceback to response: - `src/pyload/webui/app/handlers.py:14-27` - `tb = traceback.format_exc()` - `messages.extend(tb.split(&#39;\n&#39;))` - returned in rendered error page for all exceptions</p> <p>3. Error page renders all `messages`: - `src/pyload/webui/app/themes/modern/templates/base.html:217-219` - loops over `messages` and prints them in response HTML</p> <p>So any unhandled exception can disclose internal implementation details (stack frames, source paths, exception metadata) to remote unauthenticated clients.</p> <p>This is a core behavior issue in default WebUI error handling</p> <p>### PoC ```python #!/usr/bin/env python3 from __future__ import annotations</p> <p>import re import shutil import tempfile import traceback from pathlib import Path…</p> https://cve.radiocsirt.org/vuln/ghsa-c3gc-9pf2-84gg