CVE-2026-40348 Overview
CVE-2026-40348 is a Server-Side Request Forgery (SSRF) vulnerability in Movary, a self-hosted web application designed for tracking and rating watched movies. The vulnerability exists in the Jellyfin server URL verification endpoint, allowing authenticated users to trigger arbitrary server-side HTTP requests to internal network targets.
Prior to version 0.71.1, an ordinary authenticated user can exploit the POST /settings/jellyfin/server-url-verify endpoint to perform SSRF attacks. The endpoint accepts a user-controlled URL, appends /system/info/public, and issues a server-side HTTP request using the Guzzle HTTP client without any validation against internal hosts, loopback addresses, or private network ranges.
Critical Impact
Authenticated attackers can perform internal network reconnaissance, probe internal services, and potentially access cloud metadata endpoints or internal administrative interfaces not directly accessible from external networks.
Affected Products
- Movary versions prior to 0.71.1
- Self-hosted Movary deployments with Jellyfin integration enabled
- Deployments in cloud environments with accessible metadata services
Discovery Timeline
- April 18, 2026 - CVE-2026-40348 published to NVD
- April 20, 2026 - Last updated in NVD database
Technical Details for CVE-2026-40348
Vulnerability Analysis
This SSRF vulnerability (CWE-918) allows authenticated users to abuse the Jellyfin server URL verification functionality to make the Movary server perform HTTP requests to arbitrary destinations. The vulnerability occurs because the application fails to implement proper URL validation before issuing server-side requests.
When a user submits a URL through the vulnerable endpoint, the server-side code appends /system/info/public to the provided URL and makes an HTTP request using the Guzzle HTTP client library. The lack of input validation allows attackers to target internal network resources, cloud metadata services (such as 169.254.169.254 on AWS/GCP/Azure), and other services accessible only from the server's network position.
The scope change indicated in the vulnerability assessment means that successful exploitation can impact resources beyond the vulnerable component itself, potentially compromising internal infrastructure security.
Root Cause
The root cause of this vulnerability is insufficient input validation on the URL parameter submitted to the /settings/jellyfin/server-url-verify endpoint. The application does not implement any of the following critical security controls:
- Validation against private IP address ranges (RFC 1918)
- Blocking of loopback addresses (127.0.0.0/8, ::1)
- DNS rebinding protection
- URL scheme restrictions (allowing http:// and https:// to internal targets)
- Blocklist or allowlist for permitted destination hosts
Attack Vector
The attack vector is network-based and requires low-privileged authentication. An attacker with a standard user account can exploit this vulnerability by sending crafted POST requests to the Jellyfin server URL verification endpoint.
The attack flow involves submitting internal network addresses or cloud metadata endpoint URLs to the verification endpoint, which causes the server to make HTTP requests to those targets and return response information that reveals network topology, service availability, and potentially sensitive configuration data.
For technical details on the vulnerability and its remediation, see the GitHub Security Advisory GHSA-2m2v-v563-qqvj and the associated pull request.
Detection Methods for CVE-2026-40348
Indicators of Compromise
- Unusual POST requests to /settings/jellyfin/server-url-verify containing internal IP addresses or cloud metadata endpoints
- HTTP requests from the Movary server to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
- Server-side requests to cloud metadata services (169.254.169.254)
- Multiple rapid requests to the verification endpoint from a single user session
Detection Strategies
- Monitor web application logs for requests to /settings/jellyfin/server-url-verify with suspicious URL parameters
- Implement network monitoring to detect outbound HTTP connections from the Movary server to internal addresses
- Deploy web application firewall (WAF) rules to detect SSRF patterns in request bodies
- Configure egress filtering alerts for connections to metadata service IPs and internal network ranges
Monitoring Recommendations
- Enable detailed logging for all requests to settings-related endpoints
- Set up alerts for any server-initiated connections to RFC 1918 private address ranges
- Monitor for DNS queries from the application server to internal hostnames
- Track authentication events correlated with settings endpoint access patterns
How to Mitigate CVE-2026-40348
Immediate Actions Required
- Upgrade Movary to version 0.71.1 or later immediately
- Restrict network egress from the Movary server to only necessary external services
- Review logs for evidence of exploitation attempts
- Audit user accounts for unauthorized access or suspicious activity
Patch Information
The vulnerability is fixed in Movary version 0.71.1. The fix implements proper URL validation to prevent requests to internal network targets. Administrators should upgrade to this version or later to remediate the vulnerability.
Relevant resources:
Workarounds
- Implement network-level egress filtering to block outbound connections from the Movary server to internal IP ranges
- Deploy a reverse proxy with URL validation to filter requests containing internal addresses before they reach the application
- Restrict access to the settings endpoints using web server configuration or authentication controls
- Disable or restrict Jellyfin integration functionality if not required in your deployment
# Example iptables rules to restrict egress to private networks
# Apply on the host running Movary
# Block outbound to private IPv4 ranges from the Movary application
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner www-data -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
