GitHub Advisoryadvisory · Go

GHSA-xc93-q32j-cpcg Jellysweep uses uncontrolled data in image cache API endpoint

HIGH Published 2025-11-04 Modified 2025-11-07 Official page ↗
Aliases
CVE-2025-64178
Ecosystem
Go
Packages
github.com/jon4hz/jellysweep
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Weaknesses
CWE-918
Reviewed
2025-11-04

Affected packages

• Go github.com/jon4hz/jellysweep: < 0.13.0 → fixed in 0.13.0

Description

Impact The `/api/images/cache` which is used to download media posters from the server accepted an `url` parameter, which was directly passed to the cache package and that downloaded the poster from this URL. This URL parameter can be used to make the jellysweep server download arbitrary content. The API endpoint can only be used by authenticated users. Patches Fixed in `v0.13.0`. The affected (and now fixed) library was also moved to `internal/` because it wasn't meant to be imported. References https://github.com/jon4hz/jellysweep/security/code-scanning/28

Related

Alias · CVE (1)

  • CVE-2025-64178 Jellysweep is a cleanup tool for the Jellyfin media server. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References