| Название | alexta69 MeTube up to 2026.09.26 Server-Side Request Forgery |
|---|
| Описание | A vulnerability was found in alexta69 MeTube up to 2026.09.26. The affected function is DownloadQueue.__write_feed_metadata_sync in app/ytdl.py, reached through the POST /add endpoint.
When a playlist or channel URL is added, MeTube writes feed-level metadata in its main process using a plain yt-dlp instance. The feed thumbnail URL is taken from the remote page (og:image) and is therefore attacker-controlled. This URL is never checked by validate_url (which only sees the submitted page URL), and the connect-time socket guard install_socket_guard is installed only in the download subprocess, not in the main process. The server fetches the thumbnail URL and writes the response body into the download directory, which is served by the /download/ route, so the attacker can read the response back.
This results in server-side request forgery with full response read-back, for example against loopback services or cloud metadata endpoints. The attack can be launched remotely. Exploitation requires the instance to have thumbnail writing (writethumbnail) enabled.
CWE-918 (Server-Side Request Forgery). Vendor-assessed severity: 5.9 (Moderate).
The vendor was contacted beforehand, confirmed the issue and published advisory GHSA-hq22-f7w6-p8cr. Upgrading to version 2026.09.29 addresses this issue. No CVE has been assigned.
Product: https://github.com/alexta69/metube |
|---|
| Источник | ⚠️ https://github.com/alexta69/metube/security/advisories/GHSA-hq22-f7w6-p8cr |
|---|
| Пользователь | lijunjie (UID 101496) |
|---|
| Представление | 01.10.2026 12:46 (18 дни назад) |
|---|
| Модерация | 18.10.2026 15:50 (17 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 421755 [alexta69 MeTube до 2026.09.28 Feed-metadata Thumbnail Fetch app/ytdl.py DownloadQueue.__write_feed_metadata_sync эскалация привилегий] |
|---|
| Баллы | 20 |
|---|