CVE-2026-78051

CVE-2026-78051 is a path traversal in MeTube's cookie handler — a component that reads user-supplied filename values from cookies and accesses the corresponding file on disk. The vulnerability lets an attacker use traversal sequences (../../) in the cookie value to access files outside the intended directory. Patch it, but understand what you're actually patching. The low CVSS (5.3) and EPSS (0.00532) create a misleading impression of low risk. EPSS measures detection opportunity, not impact — and this isn't a static file server. Cookie handlers in YouTube downloaders frequently store authentication tokens for third-party services, sometimes including Google credentials. The blast radius of successful exploitation isn't reading a config file; it's potential credential exposure. The EPSS score reflects the fact that small open-source projects with minimal telemetry almost never generate the scanner activity that feeds these models. Low observed exploitation is not the same as low potential impact. There's a deeper pattern worth recognizing: path traversal keeps appearing in peripheral code — auxiliary features that developers regard as routine rather than security-relevant. Cookie handling isn't the core value of MeTube (that's the download logic), so it receives less security review attention. This is maintenance entropy — the security assumptions embedded in forgotten components rot while the threat landscape doesn't. The patch being a single commit suggests a localized fix, but the question every defender should ask is whether their own projects have equivalent forgotten components handling sensitive data with the same casual path construction. For this specific CVE, verify: whether your cookie handler or any file-reading component constructs paths by joining a base directory with unsanitized user input; whether the accessed files contain credentials, tokens, or other sensitive data; and whether the component has received any security review since it was written. For the broader ecosystem, recognize that EPSS scores on niche projects measure scanner coverage, not risk — and the most dangerous vulnerabilities often live in the code nobody is watching.

Reviewed through automated stages and approved by a human before publication.