Vulnerabilities

TI-2026-27237 CVE-2026-35034

Jellyfin: Potential Application DoS from excessively large SyncPlay group names

LOW 28

Jellyfin is an open source self hosted media server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0026 Published 2026-04-14 Fixed in 10.11.7 CWE-400

TI-2026-27236 CVE-2026-35033

Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection

MEDIUM 48

Jellyfin is an open source self hosted media server.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00319 Published 2026-04-14 Fixed in 10.11.7 CWE-862

TI-2026-27235 CVE-2026-35032

Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner

LOW 39

Jellyfin is an open source self hosted media server.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00312 Published 2026-04-14 Fixed in 10.11.7 CWE-73

TI-2026-27234 CVE-2026-35031

Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

MEDIUM 44

Jellyfin is an open source self hosted media server.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00753 Published 2026-04-14 Fixed in 10.11.7 CWE-187

TI-2026-24405 CVE-2026-31852

Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

MEDIUM 49

Jellyfin is an open-source media system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00522 Published 2026-03-11 Fixed in 109217e CWE-269

TI-2025-22679 CVE-2025-31499

Jellyfin Vulnerable to Argument Injection in FFmpeg

LOW 35

Jellyfin is an open source self hosted media server.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00798 Published 2025-04-15 Fixed in 10.10.7 CWE-88

TI-2025-23136 CVE-2025-32012

Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing

LOW 23

Jellyfin is an open source self hosted media server.

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.00764 Published 2025-04-15 Fixed in 10.10.7 CWE-290

TI-2024-29395 CVE-2024-43801

Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin

LOW 24

Jellyfin is an open source self hosted media server.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00332 Published 2024-09-02 Fixed in 10.9.10 CWE-200

TI-2023-26541 CVE-2023-48702

Jellyfin Possible Remote Code Execution via custom FFmpeg binary

LOW 34

Jellyfin is a system for managing and streaming media.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01196 Published 2023-12-13 Fixed in 10.8.13 CWE-77

TI-2023-26761 CVE-2023-49096

Argument Injection in FFmpeg codec parameters in Jellyfin

HIGH 73

Jellyfin is a Free Software Media System for managing and streaming media.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01251 Published 2023-12-06 Fixed in 10.8.13 CWE-88

TI-2023-14443 CVE-2023-30627

jellyfin-web has a stored cross-site scripting vulnerability in devices.js

MEDIUM 44

jellyfin-web is the web client for Jellyfin, a free-software media system.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.01281 Published 2023-04-24 Fixed in 10.8.10 CWE-79

TI-2023-14442 CVE-2023-30626 · GHSA-9p5f-5x8v-x65m

Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution

MEDIUM 44

Jellyfin is a free-software media system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01972 Published 2023-04-24 Fixed in 10.8.10 CWE-22

TI-2023-11950 CVE-2023-27161 · GHSA-cw4m-8qhc-m96h

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via…

LOW 35

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00966 Published 2023-03-10 No fix listed CWE-918

TI-2023-09464 CVE-2023-23636 · GHSA-2h5r-cqfc-45v6

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS.

MEDIUM 60

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00643 Published 2023-02-03 Fixed in 10.8.4 CWE-79

TI-2023-09463 CVE-2023-23635 · GHSA-749c-pc87-4qcw

In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS.

MEDIUM 60

In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00562 Published 2023-02-03 Fixed in 10.8.4 CWE-79

TI-2022-16336 CVE-2022-35909 · GHSA-qwp3-5fw3-5wgv

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.

MEDIUM 41

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01693 Published 2022-08-19 Fixed in 10.8.0 CWE-79

TI-2022-16337 CVE-2022-35910 · GHSA-47hr-p594-c996

In Jellyfin before 10.8, stored XSS allows theft of an admin access token.

LOW 26

In Jellyfin before 10.8, stored XSS allows theft of an admin access token.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00898 Published 2022-08-19 No fix listed CWE-79

TI-2021-10203 CVE-2021-29490

Unauthenticated GET requests through Remote Image endpoints

MEDIUM 64

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.71654 Published 2021-05-05 No fix listed CWE-918

TI-2021-04500 CVE-2021-21402

Unauthenticated Arbitrary File Access in Jellyfin

HIGH 74

Jellyfin is a Free Software Media System.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.79313 Published 2021-03-23 Fixed in 10.7.1 CWE-22

Vulnerabilities

Filters