Unknown · Moviepilot · CVE-2026-10107
**Name of the Vulnerable Software and Affected Versions**
MoviePilot version v2
**Description**
An issue exists in the image proxy endpoint '/api/v1/system/img/{proxy}' that allows authenticated attackers to request arbitrary URLs. By providing a `resource token` cookie and a URL with a domain that matches the allowlist, attackers can bypass internal network protections. This occurs because the `is safe url()` function in `SecurityUtils` only verifies domain membership and fails to block private, loopback, or link-local addresses. This can lead to the enumeration of internal services, such as Jellyfin, Emby, or Plex, and the exfiltration of data from internal network resources. Server-side request forgery (SSRF) is a flaw where an attacker can force a server to make requests to an unintended location.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.