Is CVE-2026-10107 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10107 being exploited in the wild.

How severe is CVE-2026-10107?

High severity, with a CVSS score of 7.7, published 29 May 2026.

Is there a fix for CVE-2026-10107?

A patch was published on 2026-05-24: Fix commit 0b7854a0af8751160b68c43c46ded48d2bd8a212 pushed to repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10107 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10107?

Check whether you run Jxxghp MoviePilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10107: jxxghp MoviePilot SSRF in image proxy endpoint

CVE-2026-10107 · Severity: high · CVSS 7.7 · Published 2026-05-29

MoviePilot, an automated media management tool, contains a security vulnerability in its image processing component. An authenticated user can trick the server into making unauthorized requests to internal network services, such as media servers (Jellyfin, Emby, Plex) or other private infrastructure. This could allow an attacker to scan the internal network, steal sensitive configuration data, or access private information that is not intended to be exposed to the internet.

Technologies: Jxxghp MoviePilot. Vendors: Jxxghp.

Quick answers

Is CVE-2026-10107 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10107 being exploited in the wild.
How severe is CVE-2026-10107?: High severity, with a CVSS score of 7.7, published 29 May 2026.
Which products and versions are affected?: Jxxghp MoviePilot <= v2.13.2.
Is there a fix for CVE-2026-10107?: A patch was published on 2026-05-24: Fix commit 0b7854a0af8751160b68c43c46ded48d2bd8a212 pushed to repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10107 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10107?: Check whether you run Jxxghp MoviePilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v1/system/img/{proxy}` endpoint of MoviePilot v2. The vulnerability stems from insufficient validation in the `SecurityUtils.is_safe_url` function, which performs domain-membership checks against an allowlist but fails to block private, loopback, or link-local IP addresses. Because the allowlist dynamically includes user-configured media server hosts (often internal IPs), an authenticated attacker with a `resource_token` can bypass intended restrictions to enumerate internal services or exfiltrate data from the local network. The issue was addressed by introducing a `block_private` parameter in the safety check. A fix is available in commit 0b7854a and versions following v2.13.2.

Affected products

jxxghp MoviePilot <= v2.13.2

Timeline

2026-05-24: patched: Fix commit 0b7854a0af8751160b68c43c46ded48d2bd8a212 pushed to repository.
2026-05-27: advisory: Release v2.13.2 published.
2026-05-29: disclosed: CVE-2026-10107 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.