Read the docs
TI-2026-08860 Aliases CVE-2026-10107GHSA-4hhq-38m9-mgg7

MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint

Priority MEDIUM 64CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the assembled allowlist. Attackers can bypass internal network protections because the SecurityUtils.is_safe_url function performs only domain-membership checking without blocking private, loopback, or link-local addresses, enabling enumeration of internal services such as Jellyfin, Emby, or Plex and exfiltration of data from internal network resources.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jxxghpMoviePilotup to v2.13.2; up to 0b7854a0af8751160b68c43c46ded48d2bd8a212—No fix listedCNA
  • MoviePilot Vendorjxxghp Affected up to v2.13.2; up to 0b7854a0af8751160b68c43c46ded48d2bd8a212 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-10107
  2. 2026-10-03 Alias added: GHSA-4hhq-38m9-mgg7

References

Patch 2

Other 1

  • TI-2026-09852 MoviePilot Path Traversal via Cloud Storage Download Handlers CVSS 4.0HIGH 7.2
  • TI-2026-83672 Deserialization flaw in jxxghp MoviePilot Workflow Fork Endpoint CVSS 4.0MEDIUM 5.1
  • TI-2026-74575 Command injection in MoviePilot allows remote code execution CVSS 4.0HIGH 8.7
  • TI-2026-13565 jxxghp MoviePilot Application API improper authorization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences