CVE-2026-40348

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40348", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-10T22:50:01.359Z", "datePublished": "2026-04-18T00:01:09.725Z", "dateUpdated": "2026-04-20T16:11:32.779Z"}, "containers": {"cna": {"title": "Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj"}, {"name": "https://github.com/leepeuker/movary/pull/751", "tags": ["x_refsource_MISC"], "url": "https://github.com/leepeuker/movary/pull/751"}, {"name": "https://github.com/leepeuker/movary/commit/d459b3513293d41254f7093aef07010a8e5dcf04", "tags": ["x_refsource_MISC"], "url": "https://github.com/leepeuker/movary/commit/d459b3513293d41254f7093aef07010a8e5dcf04"}, {"name": "https://github.com/leepeuker/movary/releases/tag/0.71.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/leepeuker/movary/releases/tag/0.71.1"}], "affected": [{"vendor": "leepeuker", "product": "movary", "versions": [{"version": "< 0.71.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T00:01:09.725Z"}, "descriptions": [{"lang": "en", "value": "Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint accepts a user-controlled URL, appends `/system/info/public`, and sends a server-side HTTP request with Guzzle. Because there is no restriction on internal hosts, loopback addresses, or private network ranges, this can be abused for SSRF and internal network probing. Any ordinary authenticated user can use this endpoint to make the server connect to arbitrary internal targets and distinguish between different network states. This enables SSRF-based internal reconnaissance, including host discovery, port-state probing, and service fingerprinting. In certain deployments, it may also be usable to reach internal administrative services or cloud metadata endpoints that are not directly accessible from the outside. Version 0.71.1 fixes the issue."}], "source": {"advisory": "GHSA-2m2v-v563-qqvj", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T16:11:27.734379Z", "id": "CVE-2026-40348", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:11:32.779Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40348", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:11:27.734379Z"}}}], "references": [{"url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:11:21.526Z"}}], "cna": {"title": "Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing", "source": {"advisory": "GHSA-2m2v-v563-qqvj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "leepeuker", "product": "movary", "versions": [{"status": "affected", "version": "< 0.71.1"}]}], "references": [{"url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj", "name": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/leepeuker/movary/pull/751", "name": "https://github.com/leepeuker/movary/pull/751", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/leepeuker/movary/commit/d459b3513293d41254f7093aef07010a8e5dcf04", "name": "https://github.com/leepeuker/movary/commit/d459b3513293d41254f7093aef07010a8e5dcf04", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/leepeuker/movary/releases/tag/0.71.1", "name": "https://github.com/leepeuker/movary/releases/tag/0.71.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint accepts a user-controlled URL, appends `/system/info/public`, and sends a server-side HTTP request with Guzzle. Because there is no restriction on internal hosts, loopback addresses, or private network ranges, this can be abused for SSRF and internal network probing. Any ordinary authenticated user can use this endpoint to make the server connect to arbitrary internal targets and distinguish between different network states. This enables SSRF-based internal reconnaissance, including host discovery, port-state probing, and service fingerprinting. In certain deployments, it may also be usable to reach internal administrative services or cloud metadata endpoints that are not directly accessible from the outside. Version 0.71.1 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T00:01:09.725Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40348", "state": "PUBLISHED", "dateUpdated": "2026-04-20T16:11:32.779Z", "dateReserved": "2026-04-10T22:50:01.359Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-18T00:01:09.725Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "movary", "vendor": "leepeuker", "versions": [{"status": "affected", "version": "< 0.71.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B267141-8A10-4807-B49C-F74FEB767E1F", "versionEndExcluding": "0.71.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint accepts a user-controlled URL, appends `/system/info/public`, and sends a server-side HTTP request with Guzzle. Because there is no restriction on internal hosts, loopback addresses, or private network ranges, this can be abused for SSRF and internal network probing. Any ordinary authenticated user can use this endpoint to make the server connect to arbitrary internal targets and distinguish between different network states. This enables SSRF-based internal reconnaissance, including host discovery, port-state probing, and service fingerprinting. In certain deployments, it may also be usable to reach internal administrative services or cloud metadata endpoints that are not directly accessible from the outside. Version 0.71.1 fixes the issue."}, {"lang": "es", "value": "Movary es una aplicaci\u00f3n web autoalojada para rastrear y calificar las pel\u00edculas vistas por un usuario. Antes de la versi\u00f3n 0.71.1, un usuario autenticado ordinario puede desencadenar solicitudes del lado del servidor a objetivos internos arbitrarios a trav\u00e9s de \u2019POST /settings/jellyfin/server-url-verify\u2019. El endpoint acepta una URL controlada por el usuario, a\u00f1ade \u2019/system/info/public\u2019, y env\u00eda una solicitud HTTP del lado del servidor con Guzzle. Debido a que no hay restricciones en hosts internos, direcciones de bucle invertido o rangos de red privados, esto puede ser abusado para SSRF y sondeo de red interno. Cualquier usuario autenticado ordinario puede usar este endpoint para hacer que el servidor se conecte a objetivos internos arbitrarios y distinguir entre diferentes estados de red. Esto permite el reconocimiento interno basado en SSRF, incluyendo descubrimiento de hosts, sondeo de estado de puertos y huellas digitales de servicios. En ciertas implementaciones, tambi\u00e9n puede ser utilizable para alcanzar servicios administrativos internos o endpoints de metadatos en la nube que no son directamente accesibles desde el exterior. La versi\u00f3n 0.71.1 corrige el problema."}], "id": "CVE-2026-40348", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40348", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T16:11:27.734379Z", "version": "2.0.3"}}]}, "published": "2026-04-18T00:16:38.663", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/leepeuker/movary/commit/d459b3513293d41254f7093aef07010a8e5dcf04"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/leepeuker/movary/pull/751"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/leepeuker/movary/releases/tag/0.71.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.71.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "movary", "source": "cna", "vendor": "leepeuker"}, "product": "movary", "vendor": "leepeuker"}], "analysis": {"en": {"generated_at": "2026-04-18T08:43:56.721255+00:00", "value": {"mitigation_remediation": ["Upgrade Movary to version\u202f0.71.1 or later, which removes the vulnerable endpoint.", "If upgrading immediately is infeasible, restrict access to the Jellyfin server URL verification endpoint by configuring the web server to allow only trusted hosts or block the route entirely.", "Implement firewall rules or use network segmentation to limit outbound HTTP traffic from the Movary application, and monitor logs for suspicious outbound requests."], "summary": {"action": "Apply latest patch", "impact": "Server\u2011Side Request Forgery enabling internal network probing"}, "threat_synthesis": {"affected_systems": "The vulnerability affects installations of Movary provided by the vendor leepeuker. Any deployment running a version prior to 0.71.1 and where normal users can access the web interface is impacted. The flaw is tied to the Jellyfin server URL verification function, which is present in all affected releases.", "description_and_impact": "Movary, a self\u2011hosted web application used for cataloguing watched films, contains an endpoint that accepts user\u2011supplied URLs, appends a fixed path, and sends a server\u2011side HTTP request. Before version\u202f0.71.1, any authenticated user could exploit this flaw to make the server request arbitrary internal hosts via the Guzzle client. Because no restriction is applied to the target address, attackers could probe host presence, discover open ports, and fingerprint services running inside the internal network, potentially exposing administrative interfaces or cloud metadata services that are normally inaccessible from outside.", "risk_and_exploitability": "With a CVSS score of 7.7, the vulnerability is classified as High. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog. The attack requires an authenticated user, so an attacker must first obtain legitimate credentials or compromise an account. Once authenticated, they can use the endpoint to conduct internal reconnaissance, such as host discovery, port\u2011state probing, and service fingerprinting, potentially reaching sensitive internal services. Given the lack of mitigation in the affected versions and the ability to reach otherwise unreachable internal targets, the risk level remains high for exposed or poorly segmented environments."}}}}, "created": "2026-04-18T01:30:15.918144+00:00", "updated": "2026-04-18T08:45:41.387418+00:00", "vendors": ["leepeuker", "leepeuker$PRODUCT$movary"]}