Advisories · Technology
jellyfin.
Every CVE that names jellyfin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
- jellyfin
- Broken access control
- CVSS 5.1 Medium
Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
- jellyfin
- Broken access control
- CVSS 7.1 High
Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
- jellyfin
- Server-side request forgery (SSRF)
- CVSS 5.7 Medium
Jellyfin: Potential XSS in user management
- jellyfin
- Cross-site scripting (XSS)
- CVSS 8.8 High
Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path
- jellyfin
- Command injection
- CVSS 1.7 Low
Jellyfin: Potential MKV attachment filename path traversal to RCE
- jellyfin
- Path traversal
- CVSS 8.8 High
Jellyfin: Potential Authenticated path traversal in /ClientLog/Document
- jellyfin
- Path traversal
- CVSS 6.5 Medium
Jellyfin: Potential Application DoS from excessively large SyncPlay group names
- jellyfin
- Denial of service
- CVSS 9.3 CriticalCritical · CVSS 9+
Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
- jellyfin
- Command injection
- Broken access control
- CVSS 8.6 High
Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner
- jellyfin
- Path traversal
- Server-side request forgery (SSRF)
- CVSS 10.0 CriticalCritical · CVSS 9+
Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- jellyfin
- Path traversal
- CWE-20
- CVSS 7.6 High
Jellyfin Vulnerable to Argument Injection in FFmpeg
- jellyfin
- Command injection
- CVSS 4.6 Medium
Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing
- jellyfin
- Authentication bypass
- CVSS 4.6 Medium
Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin
- jellyfin
- Information disclosure
- CVSS 7.2 High
Jellyfin Possible Remote Code Execution via custom FFmpeg binary
- jellyfin
- Command injection
- CVSS 7.7 High
Argument Injection in FFmpeg codec parameters in Jellyfin
- jellyfin
- Command injection
- CVSS 5.8 Medium
Unauthenticated GET requests through Remote Image endpoints
- jellyfin
- Server-side request forgery (SSRF)
- CVSS 7.7 HighCritical · CVSS 7+ and EPSS
Unauthenticated Arbitrary File Access in Jellyfin
- jellyfin
- Path traversal