jellyfin

Products

Exploited and recent CVEs

• CVE-2026-119551 Medium 6.5 Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions 0.3%
• CVE-2026-119550 Low 3.5 Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId} 0.2%
• CVE-2026-119549 High 7.1 Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images 0.4%
• CVE-2026-49220 Medium 5.7 Jellyfin: Potential XSS in user management 0.3%
• CVE-2026-48793 High 8.8 Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path 0.7%
• CVE-2026-49246 Low 1.7 Jellyfin: Potential MKV attachment filename path traversal to RCE 0.4%
• CVE-2026-49247 High 8.8 Jellyfin: Potential Authenticated path traversal in /ClientLog/Document 0.5%
• CVE-2026-35034 Medium 6.5 Jellyfin: Potential Application DoS from excessively large SyncPlay group names 0.3%
• CVE-2026-35033 Critical 9.3 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection 0.3%
• CVE-2026-35032 High 8.6 Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner 0.3%
• CVE-2026-35031 Critical 10.0 Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain 0.8%
• CVE-2026-31852 Critical 10.0 Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation 0.5%
• CVE-2025-31499 High 7.6 Jellyfin Vulnerable to Argument Injection in FFmpeg 0.8%
• CVE-2025-32012 Medium 4.6 Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing 0.8%
• CVE-2024-43801 Medium 4.6 Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin 0.3%
• CVE-2023-48702 High 7.2 Jellyfin Possible Remote Code Execution via custom FFmpeg binary 1.2%
• CVE-2023-49096 High 7.7 Argument Injection in FFmpeg codec parameters in Jellyfin 1.3%
• CVE-2023-30627 Critical 9.1 jellyfin-web has a stored cross-site scripting vulnerability in devices.js 1.3%
• CVE-2023-30626 High 8.8 Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution 2.0%
• CVE-2021-29490 Medium 5.8 Unauthenticated GET requests through Remote Image endpoints 69.9%
• CVE-2021-21402 High 7.7 Unauthenticated Arbitrary File Access in Jellyfin 79.3%