EUVD-2026-57237Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route, allowing a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker on a plaintext media-server connection, to supply traversal sequences that path.join and fs.writeFile normalize outside the cache directory, overwrite /app/dist/index.js or other files, and execute code as the node user after a container restart. This issue is fixed in version 3.4.0.
AnalysisAI
Path traversal via unsanitized upstream ETag and Content-Type headers in Seerr's ImageProxy allows a malicious or compromised Jellyfin or Emby media server—or a network-positioned MITM attacker on a plaintext connection—to write arbitrary files outside the cache directory, overwriting critical application files such as /app/dist/index.js for deferred code execution as the Node.js process user. All Seerr releases prior to 3.4.0 are affected; the unauthenticated /avatarproxy/:jellyfinUserId endpoint is the attack surface and requires no credentials against Seerr itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Recommended ActionAI
Within 24 hours, identify all Seerr instances in your environment and confirm their version numbers, particularly assessing whether the /avatarproxy endpoint is accessible from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. [CVSS 7.3 HIGH]
Seerr prior to version 3.1.0 leaks sensitive third-party API credentials (Pushover, Pushbullet, Telegram) through the GE
Seerr versions 2.7.0 through 3.0.x contain an authorization bypass in push subscription API endpoints that allows authen
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today