https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 08:43:11 +0000 https://vulnerability.circl.lu/vuln/cve-2024-21644 <p><strong>Affected:</strong> pyload</p> <p>pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.</p> <p><strong>Affected:</strong> pyload</p> <p>pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.</p> https://vulnerability.circl.lu/vuln/cve-2024-21644 https://vulnerability.circl.lu/vuln/pysec-2026-1820 <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>### Summary Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable.</p> <p>### Details Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable.</p> <p>### PoC Run `pyload` in the default configuration by running the following command ``` pyload ```</p> <p>Now browse to `http://localhost:8000/render/info.html`. Notice how the Flask configuration gets displayed. </p> <p>I was quite amused by this finding. I think it&#39;s a very interesting coming together of things that is so unlikely to happen. Below I will detail my process a bit more.</p> <p>I was looking through the code to see how the authorization mechanism is implemented when I spotted this route, which can be accessed by any unauthenticated actor - https://github.com/pyload/pyload/blob/57d81930edb59177c60830ad8ac36a91d0ec4c4e/src/pyload/webui/app/blueprints/app_blueprint.py#L33C1-L37C51 ```python @bp.route(&#34;/render/&lt;path:filename&gt;&#34;, endpoint=&#34;render&#34;) def render(filename): mimetype = mimetypes.guess_type(filename)[0] or &#34;text/html&#34; data = render_template(filename) return flask.Response(data, mimetype=mimetype) ```</p> <p>This route allows me to load in any of the predefined templates. However, these templates will be lacking any form of context, and as such it doesn&#39;t seem too useful. That is until I loaded the `in…</p> <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>### Summary Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable.</p> <p>### Details Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable.</p> <p>### PoC Run `pyload` in the default configuration by running the following command ``` pyload ```</p> <p>Now browse to `http://localhost:8000/render/info.html`. Notice how the Flask configuration gets displayed. </p> <p>I was quite amused by this finding. I think it&#39;s a very interesting coming together of things that is so unlikely to happen. Below I will detail my process a bit more.</p> <p>I was looking through the code to see how the authorization mechanism is implemented when I spotted this route, which can be accessed by any unauthenticated actor - https://github.com/pyload/pyload/blob/57d81930edb59177c60830ad8ac36a91d0ec4c4e/src/pyload/webui/app/blueprints/app_blueprint.py#L33C1-L37C51 ```python @bp.route(&#34;/render/&lt;path:filename&gt;&#34;, endpoint=&#34;render&#34;) def render(filename): mimetype = mimetypes.guess_type(filename)[0] or &#34;text/html&#34; data = render_template(filename) return flask.Response(data, mimetype=mimetype) ```</p> <p>This route allows me to load in any of the predefined templates. However, these templates will be lacking any form of context, and as such it doesn&#39;t seem too useful. That is until I loaded the `in…</p> https://vulnerability.circl.lu/vuln/pysec-2026-1820