CVE-2026-73291 seerr-team CVE debrief

Who should care

Administrators and users of Seerr, Jellyfin, Plex, and Emby should assess their exposure and take necessary actions to mitigate the vulnerability. This includes reviewing and updating Seerr to version 3.4.0 or later, restricting access to the GET /avatarproxy/:jellyfinUserId route, and monitoring for suspicious activity on the media server. Additionally, operators and security teams should evaluate the potential impact on their systems and implement

Why it matters

CVE-2026-73291 is a high-severity vulnerability in Seerr that allows an attacker to supply traversal sequences, potentially leading to code execution and file overwrite.

• Potential code execution as the node user after a container restart
• Overwrite of files outside the cache directory
• Traversal sequence attacks on the media server

Technical summary

The vulnerability exists in the ImageProxy component of Seerr, which allows an attacker to supply traversal sequences that can overwrite files outside the cache directory, potentially leading to code execution. This issue arises from the ImageProxy in server/lib/imageproxy.ts using upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route. A malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker on a plaintext media-server connection, can exploit this to supply traversal sequences that path.join and fs.writeFile normalize outside the cache directory, overwrite /app/dist/index.js or other files, and execute

Defensive priority

High

Recommended defensive actions

• Review and update Seerr to version 3.4.0 or later
• Restrict access to the GET /avatarproxy/:jellyfinUserId route
• Monitor for suspicious activity on the media server
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the ImageProxy component in server/lib/imageproxy.ts using the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route. This allows a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker on a plaintext media-server connection, to supply traversal sequences that path.join and fs.writeFile normalize outside the cache directory, overwrite /app/dist/index.js or other files, and execute code as the node user after a container restart.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.