CVE-2026-78051: MeTube Path Traversal Vulnerability

CVE-2026-78051 Overview

A vulnerability in the MeTube application by alexta69 exposes the cookie file /download/.metube/cookies.txt through the Cookie File Handler component. The flaw allows remote attackers to access files or directories that should not be reachable over the network. The issue affects MeTube versions up to 2026.06.10 and is resolved in version 2026.06.20 via patch ce897ee00903bf7ded406f0d7852d95dd4164add. The weakness is classified under [CWE-425: Direct Request (Forced Browsing)]. The exploit has been publicly disclosed, increasing the likelihood of opportunistic scanning against exposed MeTube instances.

Critical Impact
Remote unauthenticated attackers can retrieve the MeTube cookies.txt file, which may contain session cookies used by MeTube to authenticate against third-party sites such as YouTube.

Affected Products

alexta69 MeTube versions up to 2026.06.10
MeTube Cookie File Handler component
Self-hosted MeTube instances exposing the /download/.metube/ path

Discovery Timeline

2026-08-23 - CVE-2026-78051 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78051

Vulnerability Analysis

MeTube is a self-hosted web front end for yt-dlp that supports authenticated downloads by reading a cookies.txt file. The Cookie File Handler component serves or otherwise exposes this file at /download/.metube/cookies.txt without adequate access restrictions. An unauthenticated remote actor can request the path directly and receive the cookie file contents.

The cookie file typically stores session tokens for external services the operator has authenticated against. Disclosure of these tokens enables account takeover on those third-party services. Because MeTube is commonly deployed in home labs and small production environments behind reverse proxies, exposed instances are trivially discoverable.

Root Cause

The root cause is a forced browsing weakness in which sensitive files under the .metube directory are reachable through predictable request paths. The application does not enforce authentication or path-based access controls on the cookie file. No user interaction or prior privilege is required to trigger the disclosure.

Attack Vector

Exploitation occurs over the network by issuing an HTTP GET request to the vulnerable path on a MeTube instance. The attack requires no authentication, no user interaction, and no complex preconditions. The vulnerability manifests when the request handler returns the raw contents of /download/.metube/cookies.txt to the caller. See the GitHub Security Advisory GHSA-hj5g-p3v4-3cw5 for the maintainer's technical description.

Detection Methods for CVE-2026-78051

Indicators of Compromise

HTTP GET requests to /download/.metube/cookies.txt from external or unexpected source IPs
Successful 200 OK responses returning Netscape-format cookie data from MeTube endpoints
Access log entries showing scanning of /download/.metube/ directory paths
Unexpected sessions or logins on third-party services whose cookies MeTube stores

Detection Strategies

Alert on any request path containing .metube/cookies.txt in reverse proxy or web server access logs
Inspect response bodies for the Netscape cookie header signature # Netscape HTTP Cookie File
Correlate MeTube host access patterns with abnormal upstream authentication events on services such as YouTube or Google

Monitoring Recommendations

Ingest MeTube reverse proxy access logs into a centralized log platform for path-based analytics
Track process and file access to the cookies.txt path on the MeTube host
Monitor MeTube container images and Git tags for versions at or below 2026.06.10

How to Mitigate CVE-2026-78051

Immediate Actions Required

Upgrade MeTube to version 2026.06.20 or later, which contains patch ce897ee00903bf7ded406f0d7852d95dd4164add
Rotate all credentials and session cookies stored in any exposed cookies.txt file
Restrict MeTube access to trusted networks through a VPN, reverse proxy authentication, or firewall rules

Patch Information

The maintainer released the fix in MeTube version 2026.06.20. The corresponding commit is ce897ee00903bf7ded406f0d7852d95dd4164add, referenced in the MeTube GitHub repository and the GitHub Security Advisory GHSA-hj5g-p3v4-3cw5. Additional metadata is available at VulDB CVE-2026-78051.

Workarounds

Place MeTube behind an authenticating reverse proxy that blocks unauthenticated requests to /download/.metube/
Remove or relocate the cookies.txt file when authenticated downloads are not required
Bind the MeTube service to a loopback or private interface rather than a public network

bash

# Example nginx snippet to block external access to the cookie path
location ~* /\.metube/ {
    deny all;
    return 404;
}