CVE-2026-10107 is a server-side request forgery (SSRF) vulnerability in MoviePilot v2's image proxy endpoint. The flaw allows authenticated attackers to request arbitrary URLs by providing a resource_token cookie and a URL whose domain matches the allowlist. The SecurityUtils.is_safe_url function only verifies domain membership and does not block requests to private, loopback, or link-local IP addresses. This enables attackers to bypass internal network protections and enumerate internal services such as Jellyfin, Emby, or Plex, potentially leading to data exfiltration from internal network resources. The vulnerability affects MoviePilot versions prior to 2.13.2. There is no official patch or remediation level stated in the available data.

The vulnerability allows authenticated attackers to perform SSRF attacks that bypass internal network protections, enabling them to access and enumerate internal services and potentially exfiltrate sensitive data from internal network resources. The CVSS score of 7.7 indicates a high impact on confidentiality with no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restrict access to the affected endpoint to trusted users and consider network-level controls to limit internal service exposure.