Jellysweep versions prior to 0.13.0 contain a vulnerability in the /api/images/cache endpoint that allows authenticated users to supply a URL parameter which the server uses to download arbitrary content. This flaw enables potential server-side request forgery (SSRF) by making the server fetch unintended resources. The issue is fixed in version 0.13.0 where the vulnerable library was moved to internal use.