CVE-2026-10107
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
MoviePilot v2 contains a server-side request forgery (SSRF) vulnerability in the image proxy endpoint. An authenticated attacker can request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the configured allowlist.
Risk Assessment
Attackers can bypass internal network protections because the SecurityUtils.is_safe_url function only checks domain membership without blocking private, loopback, or link-local addresses. This allows scanning of internal services (e.g., Jellyfin, Emby, Plex) and exfiltration of data from internal network resources.
Recommendation
Update MoviePilot to the latest version that fixes this vulnerability. As a workaround, restrict access to the image proxy endpoint and implement IP address filtering at the network layer.
Other vulnerabilities in MoviePilot
See all- CVE-2026-16224Medium
A vulnerability was found in MoviePilot up to version 2.13.5 in an unknown function of the file /jxxghp/MoviePilot within the Application API component. The issue involves improper authorization, allowing remote exploitation.
- CVE-2026-11416High
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers. The local destination path is constructed by concatenating the configured download directory with a filename from remote cloud API metadata without basename normalization or path validation. An attacker controlling a filename returned by the API can use ../ sequences to write outside the configured directory, potentially overwriting arbitrary files including configuration or plugin files.
Original NVD description (English source)
MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the assembled allowlist. Attackers can bypass internal network protections because the SecurityUtils.is_safe_url function performs only domain-membership checking without blocking private, loopback, or link-local addresses, enabling enumeration of internal services such as Jellyfin, Emby, or Plex and exfiltration of data from internal network resources.