CVE-2026-112076: alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery
A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 2026.09.29 is able to resolve this issue. The name of the patch is a3896604540223ecbb8258b41b1d745d62647d16. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alexta69 MeTubeto a version that resolves this vulnerability.Fixed in 2026.09.29Patch a3896604540223ecbb8258b41b1d745d62647d16
Event History
Frequently Asked Questions
Which MeTube versions are affected and what version fixes the issue?
MeTube versions up to and including 2026.09.28 are affected. Upgrade to version 2026.09.29, which includes patch a3896604540223ecbb8258b41b1d745d62647d16.
Does exploiting this issue require an authenticated account or user interaction?
No privileges or user interaction are required according to the supplied severity vector. The attack can be launched remotely, although exploitation is described as highly complex and difficult.
What is the potential impact of a successful exploit?
A successful server-side request forgery may affect confidentiality, integrity, and availability at a low impact level. The issue is in the feed-metadata thumbnail fetching functionality in app/ytdl.py.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.