CVE-2026-10107

Name of the Vulnerable Software and Affected Versions MoviePilot version v2

Description An issue exists in the image proxy endpoint '/api/v1/system/img/{proxy}' that allows authenticated attackers to request arbitrary URLs. By providing a resource token cookie and a URL with a domain that matches the allowlist, attackers can bypass internal network protections. This occurs because the is safe url() function in SecurityUtils only verifies domain membership and fails to block private, loopback, or link-local addresses. This can lead to the enumeration of internal services, such as Jellyfin, Emby, or Plex, and the exfiltration of data from internal network resources. Server-side request forgery (SSRF) is a flaw where an attacker can force a server to make requests to an unintended location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.