Skip to content
OpenAdvisories

Vendor

jellyfin

22 known vulnerabilities.

Products

jellyfin 20 jellyfin-web 1 code-quality.yml 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-35033

    Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection

    Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions metho…

    jellyfin jellyfin
  • Critical 10.0
    CVE-2026-35031 Public exploit

    Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

    Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file exten…

    jellyfin jellyfin
  • Critical 10.0
    CVE-2026-31852 Public exploit

    Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

    Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write p…

    jellyfin code-quality.yml
  • Critical 9.1
    CVE-2023-30627

    jellyfin-web has a stored cross-site scripting vulnerability in devices.js

    jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the `REST` endpoints with admin…

    jellyfin jellyfin-web