Code execution via traversable image cache filename

Path traversal in Seerr before 3.4.0 allows attackers to overwrite files and execute code via crafted media-server responses. The ImageProxy builds a cache filename from untrusted ETag and Content-Type headers, then path.join and fs.writeFile normalize traversal sequences outside the cache directory. Exploitation requires control of a Jellyfin or Emby response or a man-in-the-middle position on a plaintext link; an unauthenticated avatar request writes the file, and code runs as the node user after restart.