CVE-2020-26948 Server-side request forgery in n/a
Attackers can exploit a Server-Side Request Forgery vulnerability in Emby Server to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-26948?
CVE-2020-26948 is a critical server-side request forgery vulnerability in n/a, published on 10 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.
Weakness: CWE-918
Which versions are affected by CVE-2020-26948?
It affects 1 product.
Products include Emby Emby.
How do I fix CVE-2020-26948?
No fix has been published for CVE-2020-26948 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-26948 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-26948 exists.
Public exploit code: 2 Metasploit modules and 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2021-25827 Auth bypass in n/a
- CVE-2025-64113 Emby Server allows attackers to gain administrative server access without preconditions
- CVE-2025-64325 Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard
- CVE-2021-25828 Cross-site scripting in n/a
- CVE-2022-36223 Cross-site scripting in n/a
Sources
Also known as GHSA-cw27-8cg2-49c9.