CVE-2026-73291: Seerr-Team Seerr

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route, allowing a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker on a plaintext media-server connection, to supply traversal sequences that path.join and fs.writeFile normalize outside the cache directory, overwrite /app/dist/index.js or other files, and execute code as the node user after a container restart. This issue is fixed in version 3.4.0.

Affected products

• Seerr-Team Seerr: before 3.4.0 (fixed in 3.4.0)

Published 2026-08-12. Last modified 2026-09-18.