Executive brief
MeTube is a self-hosted web application for downloading videos from YouTube and similar sites. A vulnerability in versions up to 2026.06.10 allows unauthenticated users to directly access uploaded cookie files through a web URL, potentially exposing sensitive account credentials that users may have uploaded. An attacker could retrieve these cookies and use them to hijack user accounts on external services.
Technical details
The vulnerability is a path traversal / directory traversal issue in MeTube's /download endpoint. The Cookie File Handler fails to restrict access to the /.metube/cookies.txt file, allowing any user with network access to retrieve uploaded cookies.txt files via HTTP GET request to /download/.metube/cookies.txt. No authentication is required, and the application ships with authentication disabled by default. An attacker can access sensitive Netscape-format cookie files containing session tokens and account credentials. The issue is resolved by upgrading to version 2026.06.20 or later, which restricts access to the /.metube directory via the /download endpoint. Patch commit: ce897ee00903bf7ded406f0d7852d95dd4164add.
Affected products
- alexta69 MeTube up to 2026.06.10
Timeline
- 2026-06-20: disclosed
- 2026-06-20: patched: Version 2026.06.20 released with fix
- 2026-08-23: advisory: CVE-2026-78051 published