Server-Side Request Forgery Vulnerability in MoviePilot v2 by MoviePilot Team

CVE-2026-10107

What is CVE-2026-10107?

The MoviePilot v2 product contains a security flaw in its image proxy endpoint, which is susceptible to server-side request forgery. This vulnerability allows attackers, upon authentication, to manipulate the application into submitting requests to arbitrary URLs by providing a resource_token cookie and a URL that matches the designated allowlist. Notably, the security mechanism, SecurityUtils.is_safe_url, merely checks for domain membership and fails to restrict private, loopback, or link-local addresses. As a result, this oversight permits attackers to bypass internal network defenses, leading to potential exposure of internal services such as Jellyfin, Emby, or Plex, as well as the risk of data leakage from sensitive internal resources.

References