Read the docs
TI-2021-04500 Aliases CVE-2021-21402

Unauthenticated Arbitrary File Access in Jellyfin

Priority HIGH 74CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.

Why it matters now

EPSS 0.79313 99th percentileScored 2026-11-07
Fix Fixed jellyfin (jellyfin): 10.7.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jellyfinjellyfinbefore 10.7.110.7.1Patch availableCNA
  • jellyfin Vendorjellyfin Affected before 10.7.1 Fixed in 10.7.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*before 10.7.1Vulnerablejellyfin
  • cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:* Versions before 10.7.1 Vulnerable ·jellyfin

Remediation

  • Fix · CNA jellyfin (jellyfin) Fixed in 10.7.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21402

References

Patch 1

Advisory 2

  • TI-2023-26761 Argument Injection in FFmpeg codec parameters in Jellyfin CVSS 3.1HIGH 8.8
  • TI-2021-10203 Unauthenticated GET requests through Remote Image endpoints CVSS 3.1MEDIUM 5.8
  • TI-2023-09464 In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. CVSS 3.1MEDIUM 5.4
  • TI-2023-09463 In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. CVSS 3.1MEDIUM 5.4
  • TI-2026-24405 Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation CVSS 3.1CRITICAL 10.0
  • TI-2026-27236 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection CVSS 4.0CRITICAL 9.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences