Vulnerability · Published Feb 3, 2025 · Assigned by GitHub_M

CVE-2025-24960Missing Input validation for filename in backups endpoint in Jellystat

High 8.7

In plain English

A high-severity path traversal in Jellystat from CyferShepard. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.5%top 55.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admin(s), there is very little scope for abuse. However, the `DELETE` `files/:filename` can be used to delete any file. This issue has been addressed in version 1.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
CyferShepard	Jellystat	< 1.1.3

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-6x46-6w9f-ffv6 x_refsource_CONFIRM
https://github.com/CyferShepard/Jellystat/pull/303 x_refsource_MISC
https://cwe.mitre.org/data/definitions/22.html x_refsource_MISC