What is GHSA-xc93-q32j-cpcg?

GHSA-xc93-q32j-cpcg is a security advisory published by GitHub Security Advisories with High severity. Jellysweep uses uncontrolled data in image cache API endpoint

Which CVE IDs does GHSA-xc93-q32j-cpcg cover?

GHSA-xc93-q32j-cpcg covers the following CVE IDs: CVE-2025-64178. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-xc93-q32j-cpcg?

GHSA-xc93-q32j-cpcg affects 1 product, including: go/github.com/jon4hz/jellysweep:\u003c 0.13.0.

GHSA-xc93-q32j-cpcgHigh

Jellysweep uses uncontrolled data in image cache API endpoint

Vendor

GitHub Security Advisories

Published

November 4, 2025

Last Modified

November 7, 2025

🔗 CVE IDs covered (1)

CVE-2025-64178 →

📋 Description

Impact

The /api/images/cache which is used to download media posters from the server accepted an url parameter, which was directly passed to the cache package and that downloaded the poster from this URL. This URL parameter can be used to make the jellysweep server download arbitrary content.

The API endpoint can only be used by authenticated users.

Patches

Fixed in v0.13.0. The affected (and now fixed) library was also moved to internal/ because it wasn't meant to be imported.

References

https://github.com/jon4hz/jellysweep/security/code-scanning/28

🎯 Affected products1

go/github.com/jon4hz/jellysweep:< 0.13.0

🔗 References (4)

https://github.com/jon4hz/jellysweep/security/advisories/GHSA-xc93-q32j-cpcg
https://github.com/jon4hz/jellysweep/commit/17466312510966418aea941e4944229856d55101
https://nvd.nist.gov/vuln/detail/CVE-2025-64178
https://github.com/advisories/GHSA-xc93-q32j-cpcg