Description

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route, allowing a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker on a plaintext media-server connection, to supply traversal sequences that path.join and fs.writeFile normalize outside the cache directory, overwrite /app/dist/index.js or other files, and execute code as the node user after a container restart. This issue is fixed in version 3.4.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-12T15:18:33.020Z",
  "pubdate": "2026-08-12T15:18:33.020Z",
  "executiveSummary": "A path traversal vulnerability exists in Seerr prior to version 3.4.0 within the ImageProxy functionality located in server/lib/imageproxy.ts.\nThe vulnerability allows a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker utilizing plaintext media-server connections, to supply directory traversal sequences via upstream HTTP response headers.\nSpecifically, the application uses upstream ETag and Content-Type response headers from the unauthenticated GET /avatarproxy/:jellyfinUserId route to construct cache filenames.\nBecause path.join and fs.writeFile normalize these untrusted inputs without adequate sanitization, an attacker can write files outside the intended cache directory.\nThis permits the overwriting of critical application files, such as /app/dist/index.js, resulting in arbitrary remote code execution as the node user following a container restart.\nThe risk is critical for deployments connecting to untrusted media servers or operating over unencrypted transport layers without mutual authentication or strict input validation.",
  "technicalDetails": "The vulnerability resides in the ImageProxy component implemented within server/lib/imageproxy.ts of Seerr prior to version 3.4.0.\nThe affected endpoint is the unauthenticated GET /avatarproxy/:jellyfinUserId route, which proxies avatar image requests to upstream Jellyfin or Emby media servers.\nDuring the processing of responses from the media server, the application extracts upstream ETag and Content-Type response headers to derive the local cache filename.\nThe root cause of the vulnerability is the unsafe combination of untrusted HTTP header values with path manipulation functions, specifically path.join and fs.writeFile.\nBecause the application fails to sanitize or validate the derived filename against directory traversal characters (e.g., ../), the path normalization process allows output file generation outside the designated cache directory.\nAn attacker controlling the upstream media server—or capable of performing a man-in-the-middle attack on a plaintext connection between Seerr and the media server—can manipulate the ETag or Content-Type headers to include directory traversal sequences.\nThe step-by-step attack flow begins when an unauthenticated client triggers a request to the GET /avatarproxy/:jellyfinUserId route.\nSeerr forwards the request to the upstream media server and receives a response containing malicious ETag or Content-Type headers engineered with path traversal patterns.\nSeerr passes these headers into the caching logic where path.join constructs the target file path, resolving traversal sequences outside the cache root.\nSubsequently, fs.writeFile writes the payload to the targeted arbitrary location on the filesystem.\nBy targeting core application files such as /app/dist/index.js, an attacker can overwrite the application source code.\nPost-exploitation impact includes arbitrary code execution under the privileges of the node user upon a container restart or application reload.\nNetwork exposure is present via the unauthenticated HTTP route, and exploitation requires either a malicious upstream media server or active network manipulation over plaintext protocols."
}