CVE-2026-10107: MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint
MoviePilot v2 contains a server-side request forgery vulnerability in the image proxy endpoint that allows authenticated attackers to request arbitrary URLs by supplying a resourcetoken cookie and a URL whose domain matches the assembled allowlist. Attackers can bypass internal network protections because the SecurityUtils.issafeurl function performs only domain-membership checking without blocking private, loopback, or link-local addresses, enabling enumeration of internal services such as Jellyfin, Emby, or Plex and exfiltration of data from internal network resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the /api/v1/system/img/{proxy} endpoint URL validation to block private, loopback, and link-local destinations (do not rely only on domain-membership checks in SecurityUtils.is_safe_url).
MoviePilot v2 /api/v1/system/img/{proxy} image proxy SSRF allowlist = block private, loopback, and link-local addresses - Compensating control
Add network-level egress restrictions for MoviePilot so it cannot reach internal networks/hosts (including private, loopback, and link-local ranges) even if SSRF occurs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10107?
CVE-2026-10107 has a high severity score of 7.7.
How do I mitigate CVE-2026-10107?
To mitigate CVE-2026-10107, update to MoviePilot v2.13.2 or later, which addresses the SSRF vulnerability.
What type of vulnerability is CVE-2026-10107?
CVE-2026-10107 is classified as a server-side request forgery (SSRF) vulnerability.
What can attackers do with CVE-2026-10107?
Attackers can exploit CVE-2026-10107 to request arbitrary URLs by supplying a valid resource_token cookie, potentially bypassing internal network protections.
Which software is affected by CVE-2026-10107?
CVE-2026-10107 affects MoviePilot v2.