CVE-2025-64178: Jellysweep uses uncontrolled data in image cache API endpoint

The vulnerability is a Server-Side Request Forgery (SSRF) in the /api/images/cache endpoint of the Jellysweep application. The root cause was the direct use of a user-provided url parameter to fetch remote content without proper validation. The analysis of the patch commit 17466312510966418aea941e4944229856d55101 reveals the key functions involved in this vulnerability.

The primary vulnerable function is handler.Handler.ImageCache located in internal/api/handler/handler.go. This function acted as the HTTP handler for the /api/images/cache endpoint. It directly extracted the url from the query string and passed it to cache.ImageCache.ServeImage. This lack of validation on the user-controlled input is the core of the vulnerability.

The function cache.ImageCache.ServeImage in internal/cache/image_cache.go is also a key part of the vulnerable execution flow. It received the tainted URL and proceeded to fetch content from it, triggering the SSRF. The patch remediates this by changing the function to accept a mediaID instead of a raw URL. It then safely retrieves the poster URL from the database using this ID.

Finally, the function arr.GetCachedImageURL in internal/engine/arr/arr.go was identified as a contributing factor. This function was responsible for creating the vulnerable URL structure, which was then used in the application's frontend. The removal of this function in the patch further confirms its role in the vulnerability.

By tracing the flow of the untrusted url parameter from the HTTP handler to the image fetching logic, these three functions are identified as the key components that, when combined, created the SSRF vulnerability.