CVE-2026-78051
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A vulnerability was found in alexta69 MeTube up to 2026.06.10. An unknown function in the file /download/.metube/cookies.txt of the Cookie File Handler component allows files or directories to be accessible. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 2026.06.20 resolves the issue.
Risk Assessment
An attacker can remotely access sensitive files such as cookies, potentially leading to session hijacking or theft of credentials. The public exploit increases the risk of exploitation.
Recommendation
Immediately upgrade MeTube to version 2026.06.20 or later, which includes the fix. After upgrading, it is also recommended to rotate all passwords and session keys that may have been exposed.
Other vulnerabilities in MeTube
See all- CVE-2026-112076Medium
A vulnerability was detected in alexta69 MeTube in the DownloadQueue.__write_feed_metadata_sync function of app/ytdl.py, related to feed-metadata thumbnail fetching. Manipulation leads to server-side request forgery, and the attack may be launched remotely though it is highly complex. The issue is fixed in version 2026.09.29 (commit a3896604540223ecbb8258b41b1d745d62647d16).
- CVE-2026-7581Medium
alexta69 MeTube up to 2026.04.09 contains a vulnerability in the on_prepare function in app/main.py related to CORS policy. The manipulation leads to a permissive cross-domain policy with untrusted domains. The exploit has been publicly disclosed and fixed in version 2026.04.10.
Original NVD description (English source)
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2026.06.20 is sufficient to resolve this issue. Patch name: ce897ee00903bf7ded406f0d7852d95dd4164add. You should upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS