CVE-2026-112076 | alexta69 MeTube up to 2026.09.28 Feed-metadata Thumbnail Fetch app/ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forgery (GHSA-hq22-f7w6-p8cr)

October 18, 2026 Yanac

A vulnerability was found in alexta69 MeTube up to 2026.09.28 and classified as problematic. This vulnerability affects the function DownloadQueue.__write_feed_metadata_sync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery.

This vulnerability is traded as CVE-2026-112076. The attack may be launched remotely. Furthermore, there is an exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More