Movary, a self‑hosted web application used for cataloguing watched films, contains an endpoint that accepts user‑supplied URLs, appends a fixed path, and sends a server‑side HTTP request. Before version 0.71.1, any authenticated user could exploit this flaw to make the server request arbitrary internal hosts via the Guzzle client. Because no restriction is applied to the target address, attackers could probe host presence, discover open ports, and fingerprint services running inside the internal network, potentially exposing administrative interfaces or cloud metadata services that are normally inaccessible from outside.

The vulnerability affects installations of Movary provided by the vendor leepeuker. Any deployment running a version prior to 0.71.1 and where normal users can access the web interface is impacted. The flaw is tied to the Jellyfin server URL verification function, which is present in all affected releases.

With a CVSS score of 7.7, the vulnerability is classified as High. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog. The attack requires an authenticated user, so an attacker must first obtain legitimate credentials or compromise an account. Once authenticated, they can use the endpoint to conduct internal reconnaissance, such as host discovery, port‑state probing, and service fingerprinting, potentially reaching sensitive internal services. Given the lack of mitigation in the affected versions and the ability to reach otherwise unreachable internal targets, the risk level remains high for exposed or poorly segmented environments.