CVE-2026-10107MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint
Updated under an hour ago ()
Does this affect you?
It affects jxxghp MoviePilot. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the assembled allowlist. Attackers can bypass internal network protections because the SecurityUtils.is_safe_url function performs only domain-membership checking without blocking private, loopback, or link-local addresses, enabling enumeration of internal services such as Jellyfin, Emby, or Plex and exfiltration of data from internal network resources.
- CVSS
- 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- Weakness (CWE)
- CWE-918
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Jun 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
jxxghp MoviePilot jxxghp:moviepilot (from the name) | through v2.13.2; through 0b7854a0af8751160b68c43c46ded48d2bd8a212 | CNA record |
References
- https://github.com/jxxghp/MoviePilot/issues/5823issue-tracking
- https://github.com/jxxghp/MoviePilot/commit/0b7854a0af8751160b68c43c46ded48d2bd8a212patch
- https://github.com/jxxghp/MoviePilot/releases/tag/v2.13.2patch
- https://www.vulncheck.com/advisories/moviepilot-v2-ssrf-via-api-v1-system-img-proxy-endpointthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.