Skip to content
OpenAdvisories

Vendor

jellyfin

22 known vulnerabilities.

Products

jellyfin 20 jellyfin-web 1 code-quality.yml 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-35031 Public exploit

    Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

    Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file exten…

    jellyfin jellyfin
  • Critical 10.0
    CVE-2026-31852 Public exploit

    Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

    Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write p…

    jellyfin code-quality.yml