CVE-2026-40348

{"id": "CVE-2026-40348", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40348", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:11:27.734379Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "leepeuker", "product": "movary", "versions": [{"status": "affected", "version": "< 0.71.1"}]}]}], "published": "2026-04-18T00:16:38.663", "references": [{"url": "https://github.com/leepeuker/movary/commit/d459b3513293d41254f7093aef07010a8e5dcf04", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/leepeuker/movary/pull/751", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/leepeuker/movary/releases/tag/0.71.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/leepeuker/movary/security/advisories/GHSA-2m2v-v563-qqvj", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can trigger server-side requests to arbitrary internal targets through `POST /settings/jellyfin/server-url-verify`. The endpoint accepts a user-controlled URL, appends `/system/info/public`, and sends a server-side HTTP request with Guzzle. Because there is no restriction on internal hosts, loopback addresses, or private network ranges, this can be abused for SSRF and internal network probing. Any ordinary authenticated user can use this endpoint to make the server connect to arbitrary internal targets and distinguish between different network states. This enables SSRF-based internal reconnaissance, including host discovery, port-state probing, and service fingerprinting. In certain deployments, it may also be usable to reach internal administrative services or cloud metadata endpoints that are not directly accessible from the outside. Version 0.71.1 fixes the issue."}, {"lang": "es", "value": "Movary es una aplicaci\u00f3n web autoalojada para rastrear y calificar las pel\u00edculas vistas por un usuario. Antes de la versi\u00f3n 0.71.1, un usuario autenticado ordinario puede desencadenar solicitudes del lado del servidor a objetivos internos arbitrarios a trav\u00e9s de \u2019POST /settings/jellyfin/server-url-verify\u2019. El endpoint acepta una URL controlada por el usuario, a\u00f1ade \u2019/system/info/public\u2019, y env\u00eda una solicitud HTTP del lado del servidor con Guzzle. Debido a que no hay restricciones en hosts internos, direcciones de bucle invertido o rangos de red privados, esto puede ser abusado para SSRF y sondeo de red interno. Cualquier usuario autenticado ordinario puede usar este endpoint para hacer que el servidor se conecte a objetivos internos arbitrarios y distinguir entre diferentes estados de red. Esto permite el reconocimiento interno basado en SSRF, incluyendo descubrimiento de hosts, sondeo de estado de puertos y huellas digitales de servicios. En ciertas implementaciones, tambi\u00e9n puede ser utilizable para alcanzar servicios administrativos internos o endpoints de metadatos en la nube que no son directamente accesibles desde el exterior. La versi\u00f3n 0.71.1 corrige el problema."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:leepeuker:movary:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B267141-8A10-4807-B49C-F74FEB767E1F", "versionEndExcluding": "0.71.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}