CVE-2026-100901

Name of the Vulnerable Software and Affected Versions athlon1600 youtube-downloader versions prior to 4.0.2

Description Remote attackers can perform server-side request forgery (SSRF) by manipulating the url argument within the stream() function located in the public/stream.php file. Server-side request forgery is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update athlon1600 youtube-downloader to a version newer than 4.0.1. As a temporary workaround, restrict access to the stream() function in the public/stream.php file.