Jellyfin vulnerabilities

Products

• Jellyfin 26

Newest

• jellyfin Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions CVE-2026-119551 7.1 HighOctober 30, 2026
• jellyfin Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId} CVE-2026-119550 5.1 MediumOctober 30, 2026
• jellyfin Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images CVE-2026-119549 7.1 HighOctober 30, 2026
• jellyfin Jellyfin: Potential XSS in user management CVE-2026-49220 5.7 MediumJune 24, 2026
• jellyfin Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path CVE-2026-48793 8.8 HighJune 24, 2026
• jellyfin Jellyfin: Potential MKV attachment filename path traversal to RCE CVE-2026-49246 1.7 LowJune 24, 2026
• jellyfin Jellyfin: Potential Authenticated path traversal in /ClientLog/Document CVE-2026-49247 8.8 HighJune 24, 2026
• jellyfin Jellyfin: Potential Application DoS from excessively large SyncPlay group names CVE-2026-35034 6.5 MediumApril 14, 2026
• jellyfin Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection CVE-2026-35033 9.3 CriticalApril 14, 2026
• jellyfin Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner CVE-2026-35032 8.6 HighApril 14, 2026
• jellyfin Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain CVE-2026-35031 Public exploit 10.0 CriticalApril 14, 2026
• jellyfin code-quality.yml, jellyfin +1 more Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation CVE-2026-31852 Public exploit 10.0 CriticalMarch 11, 2026
• jellyfin Jellyfin Vulnerable to Argument Injection in FFmpeg CVE-2025-31499 7.6 HighApril 15, 2025
• jellyfin Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing CVE-2025-32012 4.6 MediumApril 15, 2025
• jellyfin Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin CVE-2024-43801 4.6 MediumSeptember 2, 2024
• jellyfin Jellyfin Possible Remote Code Execution via custom FFmpeg binary CVE-2023-48702 7.2 HighDecember 13, 2023
• jellyfin Argument Injection in FFmpeg codec parameters in Jellyfin CVE-2023-49096 7.7 HighDecember 6, 2023
• jellyfin, jellyfin jellyfin-web +1 more jellyfin-web has a stored cross-site scripting vulnerability in devices.js CVE-2023-30627 9.1 CriticalApril 24, 2023
• jellyfin Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution CVE-2023-30626 Fix available 8.8 HighApril 24, 2023
• jellyfin Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the... CVE-2023-27161 7.5 HighMarch 10, 2023
• jellyfin Jellyfin Web Cross-Site Scripting (XSS) via Playlist Name CVE-2023-23636 Fix available 5.4 MediumFebruary 3, 2023
• jellyfin Jellyfin Web Cross-Site Scripting (XSS) via Collection Name CVE-2023-23635 Fix available 5.4 MediumFebruary 3, 2023
• jellyfin Incorrect Access Control and Cross Site Scripting in Jellyfin CVE-2022-35909 Fix available 8.8 HighAugust 19, 2022
• jellyfin In Jellyfin before 10.8, stored XSS allows theft of an admin access token. CVE-2022-35910 5.4 MediumAugust 19, 2022
• jellyfin Unauthenticated GET requests through Remote Image endpoints CVE-2021-29490 EPSS 69.9% 5.8 MediumMay 5, 2021
• jellyfin Unauthenticated Arbitrary File Access in Jellyfin CVE-2021-21402 Public exploit EPSS 79.3% 7.7 HighMarch 23, 2021