Seerr CVE-2026-72091 Path Traversal to RCE via AvatarProxy

Vulnerability Overview Vulnerability Name: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag Vulnerability Type: Path Traversal leading to Arbitrary File Write and Remote Code Execution (RCE) Vulnerability Description: Vulnerability ID: CVE-22 / CWE-94 Details: In seerr's ImageProxy, an attacker can overwrite arbitrary files on disk, including the application's entry point, by controlling the HTTP response from the media server, leading to remote code execution. Impact: An attacker can control the HTTP response from the media server to overwrite arbitrary files, including the application's entry point, resulting in remote code execution. Affected Versions Affected Versions: < 3.4.0 Fixed Version: 3.4.0 Remediation Remediation: Upgrade to version 3.4.0 or later. Vulnerability Details Type: Path Traversal (CWE-22), leading to Arbitrary File Write and Remote Code Execution (CWE-94). Impact: An attacker can control the HTTP response from the media server to overwrite arbitrary files, including the application's entry point, resulting in remote code execution. Exploitation Vector: - (Unauthenticated) - Root Cause: The cache filename on disk is constructed by directly inserting the upstream ETag response header, with double quotes stripped ( ). The filename is passed through and ( ), where embedded sequences allow writing to escape the expected cache directory. The extension of the written file is derived from the upstream header ( ), allowing the attacker to select and target the application's entry point. Expected Behavior The cache filename should be derived from values that cannot contain traversal sequences. The resulting path should also be validated to ensure it remains within the expected cache directory. Actual Behavior Currently, any response from the configured media server can provide an ETag such as , used along with a body. A single unauthenticated request to triggers both, overwriting and injecting attacker-controlled code. Upon the next container restart, the injected code will execute inside the container as the user (uid 1000). Credits Reporter: Jan Kahnen, tuningo (jan@tuningo.de) Code Blocks Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: High - Availability: High CVSS v3 Base Metrics: - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H CVE ID: CVE-2026-72091 Weaknesses: - CWE-22 - CWE-94 Credits: - Reporter: kah-ja - Fix Reviewer: OrSysR28 - Fix Developer: gauthier-th - Fix Reviewer: M0N5tRRR - Fix Reviewer: fallenbagel Summary This vulnerability is a path traversal issue that can lead to remote code execution. Affected versions are < 3.4.0, and the remediation is to upgrade to 3.4.0 or later.

Goal Reached Thanks to every supporter — we hit 100%!

Seerr CVE-2026-72091 Path Traversal to RCE via AvatarProxy

More from this source