Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119549Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

High 7.1

In plain English

A high-severity server-side request forgery in jellyfin from jellyfin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 61.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.

Affected products (as reported)

Vendor	Product	Versions
jellyfin	jellyfin	0 – through 12.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

References

https://github.com/jellyfin/jellyfin/blob/v12.4/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs#L169-L173 technical-description
https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/ImageController.cs#L96 technical-description
GitHub Security Advisory (GHSA-cf3c-8m59-2vhx) related, vendor-advisory
https://abraxaslabs.tech/research/jellyfin-svg-gzip third-party-advisory
https://github.com/jellyfin/jellyfin product
VulnCheck Advisory: Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images third-party-advisory