Prior to version 0.5.0b3.dev100, the pyload-ng WebUI displays full Python traceback details when an unhandled exception occurs. The publicly exposed /web/<path:filename> endpoint permits unauthenticated users to supply arbitrary template names, allowing the attacker to easily trigger a server error. The resulting HTTP response contains internal stack traces that may reveal sensitive data such as file paths, configuration values, or internal logic. This flaw is classified as CWE-209, an information exposure through an error message issue, and can help an attacker gain insight into the backend environment.

The vulnerable product is pyload, the open‑source download manager, specifically any release prior to 0.5.0b3.dev100. Users of these earlier versions should note that the vulnerability affects the WebUI component exposed without authentication.

The CVSS score of 5.3 indicates a moderate severity. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been actively exploited in the wild. The attack path is straightforward: an unauthenticated request to a non‑existent template triggers the error handler and returns the stack trace. Because no special privileges or zero‑day conditions are required, the exploitation likelihood is relatively high for anyone who can reach the WebUI endpoint.