Vulnerability · Published Dec 9, 2025 · Assigned by GitHub_M
CVE-2025-64113Emby Server allows attackers to gain administrative server access without preconditions
Critical 9.3
In plain English
A critical-severity security flaw in security from EmbySupport. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby Server administration, not at the OS level). Other than network access, no specific preconditions need to be fulfilled for a server to be vulnerable. This issue is fixed in version 4.9.1.81.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | mediabrowser.server.core | 4.9.1.81 | GHSA-95fv-5gfj-2r84 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EmbySupport | security | < 4.9.1.81 |
Weakness: CWE-640 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L