CVE-2020-26948: Emby Server SSRF in RemoteSearch Image URL parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCritical CVSS score and very high EPSS probability with a public proof-of-concept, but no KEV listing or confirmed in-the-wild exploitation in the record.

What it is

Emby Server before 4.5.0 is vulnerable to server-side request forgery through the ImageURL parameter of the Items/RemoteSearch/Image endpoint. An unauthenticated remote attacker can make the server issue requests to arbitrary URLs, which matters because the server may reach internal services not otherwise exposed. The record is thin: no affected version list beyond the pre-4.5.0 boundary and no vendor advisory are provided.

Impact

An attacker gains the ability to have the Emby server perform HTTP requests on their behalf, enabling access to internal network resources and potentially cloud metadata endpoints. The CVSS vector rates confidentiality, integrity and availability impact as high, though the description only substantiates SSRF.

Attack surface

Reachable over the network through the Items/RemoteSearch/Image endpoint with the ImageURL parameter; the CVSS vector indicates no authentication and no user interaction are required. No further detail on request format is given in the record.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.87154 (99.74th percentile), suggesting active interest. The only references are third-party GitHub proof-of-concept and scanner code, one of which is marked as a broken link.

What to do

• Upgrade Emby Server to 4.5.0 or later, which is the version boundary stated in the record.
• Restrict outbound network access from the Emby server to only required destinations, blocking access to internal ranges and cloud metadata addresses.
• Place the Emby server behind a reverse proxy or firewall rule that limits exposure of the Items/RemoteSearch endpoints to trusted networks.
• Validate or block user-supplied ImageURL values at the application layer if upgrading cannot be done immediately.

Detection

• Monitor Emby server logs for requests to Items/RemoteSearch/Image with external or unusual ImageURL values.
• Alert on outbound HTTP connections originating from the Emby server to internal RFC1918 addresses or link-local metadata IPs.
• Watch for repeated or scanning-style requests to the RemoteSearch image endpoint from single source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.