Movary before version 0.71.1 contains an SSRF vulnerability (CWE-918) in the POST /settings/jellyfin/server-url-verify endpoint. This endpoint accepts a user-controlled URL, appends /system/info/public, and performs a server-side HTTP request using Guzzle without restricting internal, loopback, or private network addresses. As a result, any authenticated user can cause the server to connect to arbitrary internal hosts, enabling internal network probing and reconnaissance. This can potentially expose internal administrative services or cloud metadata endpoints that are not externally accessible. The issue is resolved in version 0.71.1.

The vulnerability allows an authenticated user to perform SSRF attacks that can lead to internal network reconnaissance, including host discovery, port scanning, and service fingerprinting. This may expose sensitive internal services or cloud metadata endpoints, potentially aiding further attacks. The CVSS score is 7.7 (high severity) with high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild at this time.

Upgrade movary to version 0.71.1 or later, where this SSRF vulnerability is fixed. Since this is a self-hosted application, administrators should apply the update promptly to prevent abuse. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated but the fixed version is known, so upgrading is the recommended action.