CVE-2026-73291
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Seerr before version 3.4.0 has a vulnerability in ImageProxy where ETag and Content-Type headers are used to build cache filenames, allowing path traversal and file overwrite, including /app/dist/index.js, leading to code execution after container restart.
Risk Assessment
Potential remote code execution as the node user, potentially leading to full container compromise.
Recommendation
Upgrade Seerr to version 3.4.0 or later.
Original NVD description (English source)
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route, allowing a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker on a plaintext media-server connection, to supply traversal sequences that path.join and fs.writeFile normalize outside the cache directory, overwrite /app/dist/index.js or other files, and execute code as the node user after a container restart. This issue is fixed in version 3.4.0.