Vulnerability · Published May 29, 2026 · Assigned by VulnCheck

CVE-2026-10107MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint

High 7.7

In plain English

A high-severity server-side request forgery in MoviePilot from jxxghp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.2%top 83.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the assembled allowlist. Attackers can bypass internal network protections because the SecurityUtils.is_safe_url function performs only domain-membership checking without blocking private, loopback, or link-local addresses, enabling enumeration of internal services such as Jellyfin, Emby, or Plex and exfiltration of data from internal network resources.

Affected products (as reported)

Vendor	Product	Versions
jxxghp	MoviePilot	0 – through v2.13.20 – through 0b7854a0af8751160b68c43c46ded48d2bd8a212

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GitHub Issue issue-tracking
Patch Commit patch
Release Notes patch
https://www.vulncheck.com/advisories/moviepilot-v2-ssrf-via-api-v1-system-img-proxy-endpoint third-party-advisory