CVE-2026-78051 in MeTube
Summary
by MITRE • 08/23/2026
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2026.06.20 is sufficient to resolve this issue. Patch name: ce897ee00903bf7ded406f0d7852d95dd4164add. You should upgrade the affected component.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/23/2026
The vulnerability identified in alexta69 MeTube versions up to 2026.06.10 represents a critical path traversal flaw within the Cookie File Handler component, specifically affecting the processing logic associated with the /download/.metube/cookies.txt file. This security defect stems from an insufficient validation of user-supplied input directed at an unknown internal function responsible for handling cookie data retrieval and management. The core technical failure lies in the application's inability to properly sanitize or canonicalize path components before accessing files on the underlying operating system, allowing attackers to manipulate relative paths to escape the intended directory scope. By injecting specific sequences such as dot-dot-slash patterns into parameters that interact with this file handler, an adversary can redirect file read operations beyond the designated /download/.metube/ directory structure. This lack of strict boundary enforcement enables unauthorized access to arbitrary files and directories on the host system where MeTube is deployed, potentially exposing sensitive configuration data, user credentials stored in cookie files from other applications, or internal application logic that should remain inaccessible via web interfaces.
From an operational perspective, this vulnerability poses a severe risk due to its remote exploitability without requiring prior authentication in many default configurations, although the exact attack vector may depend on specific deployment settings and whether the service is exposed directly to untrusted networks. The ability to read arbitrary files can lead to significant information disclosure, which serves as a foundational step for further exploitation such as session hijacking if sensitive cookies are accessed or privilege escalation if configuration files containing database credentials or API keys are retrieved. Given that the exploit has been publicly disclosed and proof-of-concept code is available in the public domain, automated scanning tools and malicious actors can readily identify vulnerable instances on the internet. The presence of a known patch with commit identifier ce897ee00903bf7ded406f0d7852d95dd4164add indicates that the developer has acknowledged this flaw, yet the window between disclosure and widespread remediation remains a period of high risk for organizations relying on older versions.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The attack technique corresponds to ATT&CK tactic TA0006: Discovery and specifically the sub-technique T1083: File and Directory Discovery, where adversaries explore the file system to gather information for subsequent stages of an intrusion campaign. To mitigate this risk effectively, immediate upgrading to version 2026.06.20 or later is required as it incorporates the necessary code changes to enforce strict path validation and prevent directory escape sequences from being processed by the cookie handler. In addition to patching, administrators should ensure that MeTube runs with minimal file system permissions, restricting read access only to essential directories. Network-level controls such as web application firewalls can also provide a temporary layer of defense by filtering out common traversal patterns in HTTP requests targeting the /download/ endpoint until all instances are fully updated.