CVE-2025-64178 Jellysweep uses uncontrolled data in image cache API endpoint
Authenticated attackers can exploit an unvalidated URL parameter in the image cache API to force the server to download arbitrary content, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64178?
CVE-2025-64178 is a high-severity server-side request forgery vulnerability in jon4hz jellysweep, published on 6 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, accepted a URL parameter that was directly passed to the cache package, which downloaded the poster from this URL. This URL parameter can be used to make the Jellysweep server download arbitrary content. The API endpoint can only be used by authenticated users. This issue is fixed in version 0.13.0.
Weakness: CWE-918
Which versions are affected by CVE-2025-64178?
3 open source packages ship an affected version, including github.com/jon4hz/jellysweep.
| Package | Affected | Fixed in |
|---|---|---|
github.com/jon4hz/jellysweep Go | All versions | 0.13.0 |
github.com/jon4hz/jellysweep Go | All versions | 0.13.0 |
github.com/jon4hz/jellysweep Go | All versions | 0.13.0 |
How do I fix CVE-2025-64178?
Upgrade github.com/jon4hz/jellysweep to 0.13.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-64178 being exploited?
There is no known exploitation of CVE-2025-64178 in the wild and no public exploit code.
Sources
Also known as GHSA-xc93-q32j-cpcg, GO-2025-4091.