https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 05:31:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-260344 EUVD-2026-260344 https://cve.radiocsirt.org/vuln/euvd-2026-260344 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64178 <p>Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, accepted a URL parameter that was directly passed to the cache package, which downloaded the poster from this URL. This URL parameter can be used to make the Jellysweep server download arbitrary content. The API endpoint can only be used by authenticated users. This issue is fixed in version 0.13.0.</p> <p>Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, accepted a URL parameter that was directly passed to the cache package, which downloaded the poster from this URL. This URL parameter can be used to make the Jellysweep server download arbitrary content. The API endpoint can only be used by authenticated users. This issue is fixed in version 0.13.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64178 https://cve.radiocsirt.org/vuln/ghsa-xc93-q32j-cpcg <p><strong>Affected:</strong> Go: github.com/jon4hz/jellysweep</p> <p>### Impact The `/api/images/cache` which is used to download media posters from the server accepted an `url` parameter, which was directly passed to the cache package and that downloaded the poster from this URL. This URL parameter can be used to make the jellysweep server download arbitrary content.</p> <p>The API endpoint can only be used by authenticated users.</p> <p>### Patches</p> <p>Fixed in `v0.13.0`. The affected (and now fixed) library was also moved to `internal/` because it wasn&#39;t meant to be imported.</p> <p>### References https://github.com/jon4hz/jellysweep/security/code-scanning/28</p> <p><strong>Affected:</strong> Go: github.com/jon4hz/jellysweep</p> <p>### Impact The `/api/images/cache` which is used to download media posters from the server accepted an `url` parameter, which was directly passed to the cache package and that downloaded the poster from this URL. This URL parameter can be used to make the jellysweep server download arbitrary content.</p> <p>The API endpoint can only be used by authenticated users.</p> <p>### Patches</p> <p>Fixed in `v0.13.0`. The affected (and now fixed) library was also moved to `internal/` because it wasn&#39;t meant to be imported.</p> <p>### References https://github.com/jon4hz/jellysweep/security/code-scanning/28</p> https://cve.radiocsirt.org/vuln/ghsa-xc93-q32j-cpcg