Description

A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2026.06.20 is sufficient to resolve this issue. Patch name: ce897ee00903bf7ded406f0d7852d95dd4164add. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-23T00:16:50.763Z",
  "pubdate": "2026-08-23T00:16:50.763Z",
  "executiveSummary": "A vulnerability has been identified in alexta69 MeTube up to version 2026.06.10, specifically within the Cookie File Handler component processing the file /download/.metube/cookies.txt.\nThis vulnerability is classified as an arbitrary file or directory accessibility flaw, allowing remote attackers to bypass intended access restrictions and gain unauthorized access to sensitive files or directories on the underlying host system.\nThe risk implication is severe, as successful exploitation exposes internal file system structures and sensitive data without requiring prior authentication.\nThe attack can be initiated entirely remotely over the network, and because public disclosure of the exploit has occurred, the threat of active exploitation is elevated.\nMitigation requires upgrading the affected software component to version 2026.06.20 or applying the official patch referenced by the identifier ce897ee00903bf7ded406f0d7852d95dd4164add.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input validation and sanitization within the Cookie File Handler component of alexta69 MeTube.\nSpecifically, the application insecurely handles requests interacting with the target path /download/.metube/cookies.txt, failing to adequately restrict input parameters that define file or directory paths.\nThis architectural flaw enables path traversal or direct file reference manipulation, granting unauthorized retrieval or exposure of arbitrary files and directories accessible to the application's execution context.\nThe attack vector is network-based, allowing remote adversaries to initiate requests targeting the vulnerable endpoint without needing prior authentication or elevated privileges.\nThe attack flow proceeds as follows: First, the remote attacker crafts a malicious HTTP request directed at the MeTube application interface interacting with the vulnerable Cookie File Handler component.\nSecond, the application processes the request involving /download/.metube/cookies.txt without performing adequate boundary checks or normalization on the supplied path or parameters.\nThird, due to the absence of strict access controls and input validation, the underlying file retrieval mechanism evaluates the manipulated path, exposing unintended system files or directories beyond the intended web root or storage boundary.\nFinally, the contents of the targeted files or directory listings are returned in the response payload to the remote attacker, resulting in unauthorized information disclosure.\nPost-exploitation impact includes the potential exposure of sensitive configuration data, cookies, or other locally stored assets that could facilitate further compromise of the host environment."
}