Skip to content
OpenAdvisories

Product · seerr-team

seerr

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-73291

    Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthe…

    seerr-team seerr
  • High 7.3
    CVE-2026-27707

    Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in `POST /api/v1/auth/jellyfin` allows an unauthenticated attacker to register a…

    seerr-team seerr