An unauthenticated user can access the /web/<path> endpoint, which renders Jinja2 templates without authentication. This allows retrieval of templates that should be protected by @login_required, such as /logs, /settings, or /dashboard. In addition, a typo in the exception handler exposes internal Jinja2 variable names in HTTP 500 responses. The result is that an attacker can view sensitive template content, enumerate available templates, and obtain internal error details, which could aid further analysis. The weakness is consistent with authentication bypass (CWE-306) and information exposure (CWE-209).

The issue affects the pyLoad download manager, versions prior to 0.5.0b3.dev101. All platforms supported by pyLoad use the vulnerable /web/<path> route. There are no known variant product names beyond the pyLoad main distribution.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack execution requires no special privileges and can be performed over the public network by sending HTTP requests to the vulnerable endpoint. An attacker can simply request a file name that exists or does not exist and observe the 200 or 500 status code to enumerate templates. The information disclosed via the exception typo can be leveraged to understand internal Jinja2 variables, potentially aiding further attacks. Due to the lack of authentication requirement and the clear attack path, exploitation is considered feasible with minimal effort.