Seerr, an open-source media request and discovery manager, has a path traversal vulnerability (CWE-22) in its ImageProxy component before version 3.4.0. The vulnerability occurs because the server/lib/imageproxy.ts file uses upstream ETag and Content-Type response headers to construct cache filenames for the unauthenticated GET /avatarproxy/:jellyfinUserId route. An attacker controlling a Jellyfin or Emby server, or a man-in-the-middle on a plaintext media-server connection, can supply path traversal sequences that bypass path.join and fs.writeFile normalization, allowing overwriting of files outside the cache directory such as /app/dist/index.js. This can result in arbitrary code execution as the node user after the container restarts. The vulnerability is assigned CVE-2026-73291 and has a CVSS 3.1 score of 7.1 (high severity). It is fixed in Seerr version 3.4.0.

An attacker with the ability to control or intercept the upstream ETag and Content-Type headers can exploit this vulnerability to overwrite arbitrary files on the server filesystem, including critical application files. This leads to code execution as the node user after a container restart, potentially compromising the entire application environment. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Upgrade Seerr to version 3.4.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in 3.4.0.