YouTube Downloader CVE-2026-100901

Requires that the athlon1600 youtube-downloader application be internet-reachable with public/stream.php exposed; exploitation is remote and unauthenticated (PR:N/UI:N) by manipulating the url argument to stream.php. Limiting factors: after the partial fix in commit 6ffe823 only http/https destinations are reachable (file://, gopher://, dict:// and similar are blocked) and redirects are capped by MAXREDIRS, but the destination host is NOT filtered, so internal/private IPs and cloud metadata endpoints remain reachable. No patched release is available. The main real-world limiter is deployment scarcity, not exploit difficulty.

This is a genuine but low-priority issue. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC/VI/VA:L, E:P) describes a remotely reachable, unauthenticated, low-complexity server-side request forgery with limited impact across all three dimensions and no scope change - consistent with an open-proxy-style SSRF in a media-streaming endpoint. Exploit signals are mixed-but-modest: publicly available POC exists (VulDB gist), the SSVC/CVSS exploit-maturity is 'Proof-of-Concept' (E:P), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The severity ceiling is low because impact is L/L/L rather than any High, and - critically - the real-world footprint is tiny (an unmaintained hobby PHP project on GitHub). The disclosure also notes the vendor's attempted fix (commit 6ffe823) is incomplete: it only added CURLOPT_PROTOCOLS http/https and a MAXREDIRS cap but does NOT restrict the destination host, so internal-host SSRF remains. Net: real, POC-backed, but low prevalence and low impact - not an urgent priority.

A remote unauthenticated attacker sends a request to public/stream.php supplying a url parameter pointing at an internal resource (e.g. a cloud metadata endpoint or an internal http service); the server fetches it and streams the response back, disclosing internal content. A public proof-of-concept exists (gist by qianqiusujiu), and because the incomplete vendor fix still permits arbitrary http/https destinations, internal-host requests remain possible.