CVE-2026-40348 Movary has Authenticated SSRF via Jellyfin Server URL Verification that Allows Internal Network Probing
Authenticated users can exploit an SSRF vulnerability in Movary to probe internal networks and access restricted internal services via the Jellyfin server URL verification endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40348?
CVE-2026-40348 is a high-severity server-side request forgery vulnerability in leepeuker movary, published on 18 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint accepts a user-controlled URL, appends `/system/info/public`, and sends a server-side HTTP request with Guzzle. Because there is no restriction on internal hosts, loopback addresses, or private network ranges, this can be abused for SSRF and internal network probing. Any ordinary authenticated user can use this endpoint to make the server connect to arbitrary internal targets and distinguish between different network states. This enables SSRF-based internal reconnaissance, including host discovery, port-state probing, and service fingerprinting. In certain deployments, it may also be usable to reach internal administrative services or cloud metadata endpoints that are not directly accessible from the outside. Version 0.71.1 fixes the issue.
Weakness: CWE-918
Which versions are affected by CVE-2026-40348?
It affects 1 product.
Products include Leepeuker Movary.
How do I fix CVE-2026-40348?
No fix has been published for CVE-2026-40348 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-40348 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40348 exists.
Other vulnerabilities in leepeuker movary
- CVE-2026-23839 Movary vulnerable to Cross-site Scripting with `?categoryUpdated=` param
- CVE-2026-23840 Movary vulnerable to Cross-site Scripting with `?categoryDeleted=` param
- CVE-2026-23841 Movary vulnerable to Cross-site Scripting with `?categoryCreated=` param
- CVE-2026-40349 Authenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true
- CVE-2026-40350 Missing authorization in movary
Sources
Also known as GHSA-2m2v-v563-qqvj.