CVE-2025-64178
Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters from the server, accepted a URL parameter that was directly passed to the cache package, which downloaded the poster from this URL. This URL parameter can be used to make the Jellysweep server download arbitrary content. The API endpoint can only be used by authenticated users. This issue is fixed in version 0.13.0.
- Affected products
- Jellyfin, Jellysweep
- Fix
- Available
- CVSS 4.0
- 8.9 HIGH
- EPSS
- 0.3% (22th percentile)
- Weakness
- CWE-918
- NVD status
- Deferred
- Published
- 2025-11-06
CVE-2025-64178 at NVD
No indexed exploits for CVE-2025-64178 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-64178 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.