CVE-2026-10107: MoviePilot v2 SSRF Vulnerability

CVE-2026-10107 Overview

CVE-2026-10107 is a server-side request forgery (SSRF) vulnerability affecting MoviePilot v2, a self-hosted media automation application. The flaw resides in the /api/v1/system/img/proxy image proxy endpoint. Authenticated attackers can supply a resource_token cookie together with a crafted URL whose domain matches the assembled allowlist to force the server to issue arbitrary outbound requests. The vulnerability is tracked under CWE-918: Server-Side Request Forgery. Exploitation enables enumeration of internal services such as Jellyfin, Emby, and Plex, along with exfiltration of data from internal network resources reachable by the MoviePilot host.

Critical Impact
Authenticated attackers can pivot from the MoviePilot application to internal network resources, bypassing network segmentation and exposing private services to external reconnaissance.

Affected Products

MoviePilot v2 (versions prior to v2.13.2)
Self-hosted MoviePilot deployments exposing the /api/v1/system/img/proxy endpoint
Installations relying on the SecurityUtils.is_safe_url allowlist function for outbound URL validation

Discovery Timeline

2026-05-29 - CVE-2026-10107 published to the National Vulnerability Database
2026-05-29 - Last updated in NVD database
Patch released - MoviePilot v2.13.2 published with fix commit 0b7854a0af8751160b68c43c46ded48d2bd8a212

Technical Details for CVE-2026-10107

Vulnerability Analysis

The image proxy endpoint in MoviePilot v2 accepts a target URL from authenticated callers presenting a valid resource_token cookie. Before issuing the outbound request, the server validates the supplied URL through the SecurityUtils.is_safe_url function. That validator only checks whether the URL's domain is a member of a dynamically assembled allowlist. It does not resolve the target hostname or inspect the resulting IP address. Attackers can therefore submit URLs whose domain matches an allowed entry but resolves to private, loopback, or link-local addresses. The server then proxies the request to internal infrastructure on behalf of the attacker and returns the response.

Root Cause

The root cause is incomplete input validation in SecurityUtils.is_safe_url. Domain-membership checking alone cannot prevent SSRF when DNS resolution is attacker-influenced or when allowlisted domains resolve to internal address space. The validator lacks post-resolution IP filtering for RFC 1918 ranges, 127.0.0.0/8 loopback, 169.254.0.0/16 link-local, and IPv6 equivalents such as ::1 and fc00::/7.

Attack Vector

An authenticated user issues a request to /api/v1/system/img/proxy supplying a URL whose host matches the assembled allowlist. The attacker controls DNS for that host or selects allowlisted entries that resolve to internal targets. The MoviePilot backend fetches the URL server-side, exposing internal HTTP services like Jellyfin, Emby, and Plex management consoles. Response data flows back through the proxy, enabling reconnaissance and data extraction. The vulnerability requires low privileges and no user interaction, and it is exploitable over the network.

No public proof-of-concept code has been released. Refer to the VulnCheck Security Advisory and the GitHub Issue Discussion for additional technical context.

Detection Methods for CVE-2026-10107

Indicators of Compromise

Requests to /api/v1/system/img/proxy containing URL parameters that resolve to private, loopback, or link-local addresses
Outbound connections from the MoviePilot host to internal services such as Jellyfin, Emby, or Plex that did not originate from normal media-library workflows
Unusual DNS queries from the MoviePilot host for allowlisted domains resolving to RFC 1918 ranges
Repeated proxy requests cycling through internal IP ranges, indicating internal-network enumeration

Detection Strategies

Inspect reverse-proxy and application logs for img/proxy requests with url= parameters targeting internal hostnames or IP-shaped domains
Correlate authenticated session activity carrying resource_token cookies with anomalous outbound HTTP egress from the MoviePilot service
Alert on MoviePilot processes initiating connections to non-media internal services or metadata endpoints such as 169.254.169.254
Baseline normal outbound destinations for the MoviePilot host and flag deviations

Monitoring Recommendations

Forward MoviePilot application and access logs into a centralized log platform with retention sufficient for incident response
Enable egress firewall logging on the host running MoviePilot and review denied attempts to private ranges
Monitor for new or unexpected DNS resolutions of allowlisted domains to internal IP space

How to Mitigate CVE-2026-10107

Immediate Actions Required

Upgrade MoviePilot to release v2.13.2 or later, which contains the fix
Restrict access to the MoviePilot web interface to trusted users and networks, removing unnecessary internet exposure
Rotate any resource_token values and force re-authentication for existing sessions after patching
Audit recent img/proxy request logs for evidence of internal targets being reached

Patch Information

The fix is delivered in MoviePilot v2.13.2 via commit 0b7854a0af8751160b68c43c46ded48d2bd8a212. The patched validator extends URL safety checks beyond domain membership so that requests resolving to private, loopback, or link-local addresses are rejected before the proxy issues the outbound call. Operators should consult the GitHub Issue Discussion for upgrade notes.

Workarounds

Place MoviePilot on a dedicated network segment with egress filtering that blocks connections to internal subnets, loopback interfaces, and cloud metadata endpoints
Disable or block the /api/v1/system/img/proxy endpoint at a reverse proxy until the upgrade is applied
Require strong authentication and limit account creation to trusted operators, since exploitation requires a valid authenticated session

bash

# Example reverse-proxy block for the vulnerable endpoint until patched (NGINX)
location = /api/v1/system/img/proxy {
    return 403;
}