CVE-2026-73291: falha de alta gravidade em seerr-team seerr
Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.4%
Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route, allowing a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker on a plaintext media-server connection, to supply traversal sequences that path.join and fs.writeFile normalize outside the cache directory, overwrite /app/dist/index.js or other files, and execute code as the node user after a container restart. This issue is fixed in version 3.4.0.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Produtos afetados
seerr-team · seerrCVEs relacionadas — seerr-team seerr
No mesmo produto, das mais perigosas para as menos.
CVE-2026-27707HIGHPlex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpointEPSS 0.6%CVE-2026-27793MEDIUMSeerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification CredentialsEPSS 0.3%CVE-2026-27792MEDIUMSeerr missing authentication on pushSubscription endpointsEPSS 0.2%