seerr-team seerr vulnerabilities

Latest seerr-team seerr CVEs

Newest publication first

1. CVE-2026-73291 Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

   Published 2026-08-12

   High·CVSS 7.1 EPSS 0.39%

   Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarp...

2. CVE-2026-27793 Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials

   Published 2026-02-27

   Medium·CVSS 6.5 EPSS 0.27%

   Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the GET /api/v1/user/:id endpoint returns the full settings object for any user, including Pushover, Pushbullet, and Telegram credentials, to any authenticated reques...

3. CVE-2026-27792 Seerr missing authentication on pushSubscription endpoints

   Published 2026-02-27

   Medium·CVSS 5.4 EPSS 0.24%

   Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the application starting in version 2.7.0 and prior to version 3.1.0. It allows authenticated users to access and modify data bel...

4. CVE-2026-27707 Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint

   Published 2026-02-27

   Critical·CVSS 9.8 EPSS 0.56%

   Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Starting in version 2.0.0 and prior to version 3.1.0, an authentication guard logic flaw in POST /api/v1/auth/jellyfin allows an unauthenticated attacker to register a new Seerr account on a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.