PT-2025-45386 · Jellyfin+1 · Jellyfin+1

Published 2025-11-04 · Updated 2025-11-17 · CVE-2025-64178

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Jellysweep versions 0.12.1 and below

Description Jellysweep is a cleanup tool for the Jellyfin media server. The /api/images/cache API endpoint accepts a URL parameter that is directly passed to a cache package, allowing the server to download content from the provided URL. This functionality can be exploited by authenticated users to download arbitrary content.

Recommendations Update to version 13.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-64178

GHSA-XC93-Q32J-CPCG

GO-2025-4091

Affected Products

Jellyfin

Jellysweep

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64178.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64178 · Security Note
• https://osv.dev/vulnerability/GHSA-xc93-q32j-cpcg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64178 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4091 · Vendor Advisory
• https://github.com/jon4hz/jellysweep/commit/17466312510966418aea941e4944229856d55101 · Note
• https://github.com/jon4hz/jellysweep/security/advisories/GHSA-xc93-q32j-cpcg · Note
• https://github.com/jon4hz/jellysweep · Note
• https://twitter.com/CVEnew/status/1986577135902105884 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1986575235995381777 · Twitter Post
• https://t.me/CVEtracker/36721 · Telegram Post