Vulnerabilities

TI-2026-83015 CVE-2026-119551 · GHSA-72f8-2q8j-rxmr

Authorization bypass in Jellyfin lets users list restricted items

LOW 31

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the u…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00319 Published 2026-10-30 No fix listed CWE-862

TI-2026-83014 CVE-2026-119550 · GHSA-736m-vhpm-7799

Jellyfin playlist endpoint exposes hidden library items

LOW 23

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00222 Published 2026-10-30 No fix listed CWE-862

TI-2026-83013 CVE-2026-119549 · GHSA-5hqc-9wxw-2gfq

Server-side request forgery in Jellyfin profile image handling

LOW 32

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0044 Published 2026-10-30 No fix listed CWE-918

TI-2026-36421 CVE-2026-49220

Jellyfin: Potential XSS in user management

LOW 26

Jellyfin is an open source self hosted media server.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00334 Published 2026-06-24 Fixed in 10.11.9 CWE-79

TI-2026-36063 CVE-2026-48793

Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path

MEDIUM 41

Jellyfin is an open source self hosted media server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00664 Published 2026-06-24 Fixed in 10.11.10 CWE-88

TI-2026-36443 CVE-2026-49246

Jellyfin: Potential MKV attachment filename path traversal to RCE

LOW 10

Jellyfin is an open source self hosted media server.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.0037 Published 2026-06-24 Fixed in 10.11.10 CWE-22

TI-2026-36444 CVE-2026-49247

Jellyfin: Potential Authenticated path traversal in /ClientLog/Document

MEDIUM 41

Jellyfin is an open source self hosted media server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00548 Published 2026-06-24 Fixed in 10.11.10 CWE-22

TI-2026-27237 CVE-2026-35034

Jellyfin: Potential Application DoS from excessively large SyncPlay group names

LOW 28

Jellyfin is an open source self hosted media server.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0026 Published 2026-04-14 Fixed in 10.11.7 CWE-400

TI-2026-27236 CVE-2026-35033

Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection

MEDIUM 48

Jellyfin is an open source self hosted media server.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00319 Published 2026-04-14 Fixed in 10.11.7 CWE-862

TI-2026-27235 CVE-2026-35032

Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner

LOW 39

Jellyfin is an open source self hosted media server.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00312 Published 2026-04-14 Fixed in 10.11.7 CWE-73

TI-2026-27234 CVE-2026-35031

Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

MEDIUM 44

Jellyfin is an open source self hosted media server.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00753 Published 2026-04-14 Fixed in 10.11.7 CWE-187

TI-2026-24405 CVE-2026-31852

Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

MEDIUM 49

Jellyfin is an open-source media system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00522 Published 2026-03-11 Fixed in 109217e CWE-269

TI-2025-22679 CVE-2025-31499

Jellyfin Vulnerable to Argument Injection in FFmpeg

LOW 35

Jellyfin is an open source self hosted media server.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00798 Published 2025-04-15 Fixed in 10.10.7 CWE-88

TI-2025-23136 CVE-2025-32012

Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing

LOW 23

Jellyfin is an open source self hosted media server.

CVSS 4.0MEDIUM 4.6 Network No auth No interaction EPSS 0.00764 Published 2025-04-15 Fixed in 10.10.7 CWE-290

TI-2024-29395 CVE-2024-43801

Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin

LOW 24

Jellyfin is an open source self hosted media server.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00332 Published 2024-09-02 Fixed in 10.9.10 CWE-200

TI-2023-26541 CVE-2023-48702

Jellyfin Possible Remote Code Execution via custom FFmpeg binary

LOW 34

Jellyfin is a system for managing and streaming media.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01196 Published 2023-12-13 Fixed in 10.8.13 CWE-77

TI-2023-26761 CVE-2023-49096

Argument Injection in FFmpeg codec parameters in Jellyfin

HIGH 73

Jellyfin is a Free Software Media System for managing and streaming media.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01251 Published 2023-12-06 Fixed in 10.8.13 CWE-88

TI-2023-14443 CVE-2023-30627

jellyfin-web has a stored cross-site scripting vulnerability in devices.js

MEDIUM 44

jellyfin-web is the web client for Jellyfin, a free-software media system.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.01281 Published 2023-04-24 Fixed in 10.8.10 CWE-79

TI-2023-14442 CVE-2023-30626 · GHSA-9p5f-5x8v-x65m

Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution

MEDIUM 44

Jellyfin is a free-software media system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01972 Published 2023-04-24 Fixed in 10.8.10 CWE-22

TI-2023-11950 CVE-2023-27161 · GHSA-cw4m-8qhc-m96h

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via…

LOW 35

Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00966 Published 2023-03-10 No fix listed CWE-918

TI-2023-09464 CVE-2023-23636 · GHSA-2h5r-cqfc-45v6

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS.

MEDIUM 60

In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00643 Published 2023-02-03 Fixed in 10.8.4 CWE-79

TI-2023-09463 CVE-2023-23635 · GHSA-749c-pc87-4qcw

In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS.

MEDIUM 60

In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00562 Published 2023-02-03 Fixed in 10.8.4 CWE-79

TI-2022-16336 CVE-2022-35909 · GHSA-qwp3-5fw3-5wgv

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.

MEDIUM 41

In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01693 Published 2022-08-19 Fixed in 10.8.0 CWE-79

TI-2022-16337 CVE-2022-35910 · GHSA-47hr-p594-c996

In Jellyfin before 10.8, stored XSS allows theft of an admin access token.

LOW 26

In Jellyfin before 10.8, stored XSS allows theft of an admin access token.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00898 Published 2022-08-19 No fix listed CWE-79

TI-2021-10203 CVE-2021-29490

Unauthenticated GET requests through Remote Image endpoints

MEDIUM 64

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.71654 Published 2021-05-05 No fix listed CWE-918

Vulnerabilities

Filters