metube

v2026.07.13 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 13d Media Servers

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

self-hosted youtube youtube-dl yt-dlp

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 12d

The release fixes a path traversal vulnerability affecting playlist and channel title handling.

Why it matters: Severity rated 90; patch immediately to protect against directory traversal attacks in Metube's media titles.

Summary

AI summary

Fix prevents playlist and channel title path traversal vulnerability.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Fixes path traversal vulnerability in playlist/channel title handling Fixes path traversal vulnerability in playlist/channel title handling Source: llm_adapter@2026-07-14 Confidence: high	—

Full changelog

Docker Images

Docker images have been built and pushed:

Docker Hub:

alexta69/metube:latest
alexta69/metube:2026.07.13

GitHub Container Registry:

ghcr.io/alexta69/metube:latest
ghcr.io/alexta69/metube:2026.07.13

Changes

fix: prevent playlist/channel title path traversal (closes GHSA-vh67-38x4-w8pc) (fdfbfed)

Security Fixes

GHSA-vh67-38x4-w8pc — prevents path traversal in playlist and channel titles

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track metube

Get notified when new releases ship.

About metube

Self-hosted video downloader for YouTube and other sites (web UI for youtube-dl / yt-dlp)

All releases →