MeTube CVE-2026-112076

Exploitation requires the attacker to get a MeTube instance to process a feed (playlist or channel) whose thumbnail URL the attacker controls, and the instance must have metadata/thumbnail writing enabled (the regression test sets YTDL_OPTIONS writeinfojson=True and writethumbnail=True), triggering the __write_feed_metadata_sync path that fetches and persists the thumbnail. Limiting factors: the attack is explicitly rated highly complex and difficult to exploit (CVSS AC:H); impact is confined to retrieving an internal HTTP response written to the download directory (no RCE); and realistic exploitation depends on the target MeTube being reachable by the attacker and on network-adjacent internal services actually existing behind it. MeTube commonly runs without authentication, consistent with the CVSS PR:N.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 4.0 base vector (AV:N/AC:H/PR:N/UI:N/VC:L/VI:L/VA:L) scores only 2.9, and the high attack complexity (AC:H) is corroborated by the description's explicit statements that 'Attacks of this nature are highly complex' and 'the exploitability is difficult' - the signals agree rather than conflict. The E:P temporal metric and the description confirm publicly available exploit code exists, but this is a proof-of-concept, NOT active exploitation: the CVE is not listed in CISA KEV and no EPSS score was provided in the input, so real-world exploitation likelihood cannot be quantified. The technical impact is limited (all three impact metrics are Low) because the SSRF only allows fetching an internal response that is written to the download directory and served via /download - there is no code execution or full data exfiltration. The combination of high complexity, low impact, PoC-only status, and no KEV listing means this should be patched during normal maintenance rather than treated as an emergency. The source-code evidence (added SSRF-guard tests and the socket_guard_scope mitigation) confirms the vulnerability class is real and was deliberately fixed.

An attacker crafts a malicious playlist or channel feed whose thumbnail URL points at an internal service (e.g., a cloud metadata endpoint or an internal admin host) and induces a MeTube instance to process it; the server-side feed-metadata handler fetches that thumbnail and writes the internal response into the download directory, where it can then be retrieved via /download. A public proof-of-concept exists, but the attack is difficult and highly complex (CVSS AC:H), and the added regression tests show redirect-based pivots were also considered.