CVE-2025-64178 in jellysweep
Summary
by MITRE • 11/07/2025
Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, accepted a URL parameter that was directly passed to the cache package, which downloaded the poster from this URL. This URL parameter can be used to make the Jellysweep server download arbitrary content. The API endpoint can only be used by authenticated users. This issue is fixed in version 0.13.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/07/2025
The vulnerability CVE-2025-64178 represents a critical security flaw in Jellysweep, a cleanup tool designed for the Jellyfin media server ecosystem. This tool serves as an auxiliary component that helps maintain and optimize media server performance by managing cached content and removing unnecessary files. The vulnerability specifically affects versions 0.12.1 and earlier, creating a significant attack surface that could be exploited by malicious actors with valid authentication credentials. The flaw manifests in the /api/images/cache endpoint which processes URL parameters to fetch and cache media posters from external sources, establishing a direct pathway for unauthorized content retrieval.
The technical implementation of this vulnerability stems from improper input validation within the Jellysweep application's image caching mechanism. When users submit a URL parameter through the /api/images/cache endpoint, the system fails to properly sanitize or validate the input before passing it to the underlying cache package. This direct parameter propagation creates a server-side request forgery vulnerability where authenticated users can manipulate the URL parameter to target any arbitrary web resource. The cache package then executes the download operation using the user-provided URL, effectively allowing attackers to make the Jellysweep server fetch content from external sources beyond the intended media library scope. This behavior aligns with CWE-918, which describes server-side request forgery vulnerabilities where applications fail to properly validate and sanitize user-supplied URLs.
The operational impact of this vulnerability extends beyond simple content retrieval, as it enables potential attackers to leverage the Jellysweep server for various malicious activities. An authenticated attacker could use this vulnerability to download sensitive information from internal networks that the Jellysweep server might be able to access but the attacker's direct connection cannot reach. The vulnerability also poses risks for network reconnaissance, as attackers could potentially use the server to probe internal systems or test network configurations. Additionally, the malicious content downloaded through this mechanism could contain malware or other harmful payloads that might be cached and subsequently accessed by other users. This issue represents a classic case of insufficient input validation and improper parameter handling, creating a pathway for attackers to leverage legitimate server functionality for unauthorized purposes.
The fix implemented in version 0.13.0 addresses this vulnerability through proper input validation and sanitization of URL parameters. This mitigation approach aligns with security best practices and ATT&CK technique T1071.004, which covers application layer protocol manipulation. The updated version likely implements strict validation of URLs to ensure they conform to expected patterns and restricts access to only legitimate media server resources. Organizations should immediately upgrade to Jellysweep version 0.13.0 or later to remediate this vulnerability. In the interim, administrators should consider implementing additional network-level controls such as firewall rules that restrict outbound connections from the Jellysweep server to prevent unauthorized content retrieval. The vulnerability also underscores the importance of validating all user inputs, particularly in applications that interact with external resources, and demonstrates how seemingly benign functionality can create security risks when proper validation is omitted.