PT-2026-38289 · Pyload · Pyload

Gammac0De · Published 2026-05-06 · Updated 2026-05-11 · CVE-2026-44226

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev100

Description The WebUI returns full Python traceback details to clients when unhandled exceptions occur. This happens because the endpoint "/web/path:filename" is accessible without authentication and renders template names controlled by the user. An unauthenticated user can trigger a server exception, such as by requesting a non-existent template, causing the server to include internal stack traces, source paths, and exception metadata in the HTTP response. This information disclosure allows remote clients to map internal application implementation details.

Recommendations Update to version 0.5.0b3.dev100.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-44226

GHSA-C3GC-9PF2-84GG

Affected Products

Pyload

References · 5

• 🔥 https://github.com/pyload/pyload/security/advisories/GHSA-c3gc-9pf2-84gg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44226 · Security Note
• https://osv.dev/vulnerability/GHSA-c3gc-9pf2-84gg · Vendor Advisory
• https://github.com/pyload/pyload · Note
• https://twitter.com/CVEnew/status/2053932444932554946 · Twitter Post