CVE-2026-112076
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability was detected in alexta69 MeTube in the DownloadQueue.__write_feed_metadata_sync function of app/ytdl.py, related to feed-metadata thumbnail fetching. Manipulation leads to server-side request forgery, and the attack may be launched remotely though it is highly complex. The issue is fixed in version 2026.09.29 (commit a3896604540223ecbb8258b41b1d745d62647d16).
Risk Assessment
An attacker could force the server to make requests to internal resources, potentially disclosing information or reaching services not exposed externally. Exploitation is difficult due to high complexity, but the exploit is public.
Recommendation
Upgrade MeTube to version 2026.09.29 or later. Restrict outbound network requests from the application server to only necessary destinations.
Other vulnerabilities in MeTube
See all- CVE-2026-78051Medium
A vulnerability was found in alexta69 MeTube up to 2026.06.10. An unknown function in the file /download/.metube/cookies.txt of the Cookie File Handler component allows files or directories to be accessible. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 2026.06.20 resolves the issue.
- CVE-2026-7581Medium
alexta69 MeTube up to 2026.04.09 contains a vulnerability in the on_prepare function in app/main.py related to CORS policy. The manipulation leads to a permissive cross-domain policy with untrusted domains. The exploit has been publicly disclosed and fixed in version 2026.04.10.
Original NVD description (English source)
A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.09.29 is able to resolve this issue. The name of the patch is a3896604540223ecbb8258b41b1d745d62647d16. It is suggested to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS