CVE-2026-10107 Details
Description
MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the assembled allowlist. Attackers can bypass internal network protections because the SecurityUtils.is_safe_url function performs only domain-membership checking without blocking private, loopback, or link-local addresses, enabling enumeration of internal services such as Jellyfin, Emby, or Plex and exfiltration of data from internal network resources.
A server-side request forgery (SSRF) vulnerability has been identified in MoviePilot version 2, specifically within the image proxy endpoint. This vulnerability allows authenticated attackers to request arbitrary URLs by providing a resource_token cookie and a URL that matches the domain allowlist. The issue arises because the SecurityUtils.is_safe_url function only checks domain membership, failing to block private, loopback, or link-local addresses. As a result, attackers can bypass internal network protections, enumerate internal services like Jellyfin, Emby, or Plex, and exfiltrate data from internal network resources.
Users can update to MoviePilot version 2.13.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 29, 2026CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jxxghp/MoviePilot/issues/5823 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/jxxghp/MoviePilot/commit/0b7854a0af8751160b68c43c46ded48d2bd8a212 | [email protected] | Source CodeVendor |
| https://github.com/jxxghp/MoviePilot/issues/5823 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/jxxghp/MoviePilot/releases/tag/v2.13.2 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/moviepilot-v2-ssrf-via-api-v1-system-img-proxy-endpoint | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MoviePilot | <= v2.13.2 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |