EUVD-2026-23617Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
8DescriptionGitHub Advisory
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through POST /settings/jellyfin/server-url-verify. The endpoint accepts a user-controlled URL, appends /system/info/public, and sends a server-side HTTP request with Guzzle. Because there is no restriction on internal hosts, loopback addresses, or private network ranges, this can be abused for SSRF and internal network probing. Any ordinary authenticated user can use this endpoint to make the server connect to arbitrary internal targets and distinguish between different network states. This enables SSRF-based internal reconnaissance, including host discovery, port-state probing, and service fingerprinting. In certain deployments, it may also be usable to reach internal administrative services or cloud metadata endpoints that are not directly accessible from the outside. Version 0.71.1 fixes the issue.
AnalysisAI
Server-Side Request Forgery in Movary movie tracking application allows authenticated users to probe internal networks and metadata endpoints. The /settings/jellyfin/server-url-verify endpoint accepts user-controlled URLs without validating against private IP ranges, enabling internal reconnaissance through the server's context. Affects all versions prior to 0.71.1. EPSS data not available, but exploitation requires only low-privilege authentication (CVSS PR:L) with no attack complexity, making this readily exploitable by any registered user. Upstream fix confirmed in version 0.71.1 via GitHub commit d459b35.
Technical ContextAI
This vulnerability exploits the Jellyfin server URL verification feature in Movary, a self-hosted PHP web application for movie tracking. The endpoint uses the Guzzle HTTP client library to validate user-provided Jellyfin server URLs by appending /system/info/public and making an outbound request. The root cause is CWE-918 (Server-Side Request Forgery) - the application fails to implement network allow-listing or deny-listing before making HTTP requests. Because Guzzle follows user-controlled URLs without restriction, attackers can specify loopback addresses (127.0.0.1, localhost), link-local addresses (169.254.x.x), or RFC 1918 private ranges (10.x.x.x, 192.168.x.x, 172.16-31.x.x) to reach internal services. The scope change (S:C in CVSS vector) indicates the vulnerable component can impact resources beyond its security scope, which is accurate for SSRF - the web application becomes a proxy to internal infrastructure it shouldn't normally access.
RemediationAI
Upgrade Movary to version 0.71.1 or later, which implements URL validation to prevent SSRF attacks (release notes: https://github.com/leepeuker/movary/releases/tag/0.71.1, fix commit: https://github.com/leepeuker/movary/commit/d459b3513293d41254f7093aef07010a8e5dcf04, patch implementation: https://github.com/leepeuker/movary/pull/751). If immediate upgrade is not possible, implement network-level controls: configure egress firewall rules on the Movary server to block outbound connections to RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), link-local (169.254.0.0/16), and cloud metadata endpoints (169.254.169.254/32 for AWS/Azure/GCP). Note this mitigation may break legitimate Jellyfin integrations if your Jellyfin server is on a private IP - in such cases, implement allowlist rules for only your specific Jellyfin server IP. Alternatively, restrict access to the /settings/jellyfin/server-url-verify endpoint to only administrative users via web server configuration (Apache/Nginx location block with auth requirements), though this reduces functionality for regular users. Monitor HTTP access logs for requests to /settings/jellyfin/server-url-verify with suspicious URL patterns (IP addresses instead of hostnames, non-standard ports, internal IP ranges).
Movary has a third input validation vulnerability that allows authenticated users to delete arbitrary files from the ser
Movary has a second input validation vulnerability allowing authenticated users to write arbitrary files on the server,
Movary movie tracking application has an input validation flaw that allows authenticated users to read arbitrary files f
Privilege escalation in Movary (self-hosted movie tracking app) versions before 0.71.1 allows any authenticated user to
Authenticated users in Movary (self-hosted movie tracking web app) can escalate privileges to administrator via a missin
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today