Skip to content
OpenAdvisories

Vendor

jellyfin

22 known vulnerabilities.

Products

jellyfin 20 jellyfin-web 1 code-quality.yml 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-35031 Public exploit

    Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

    Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file exten…

    jellyfin jellyfin
  • Critical 10.0
    CVE-2026-31852 Public exploit

    Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation

    Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write p…

    jellyfin code-quality.yml
  • High 7.7
    CVE-2021-21402 Public exploit Scanner template EPSS 79%

    Unauthenticated Arbitrary File Access in Jellyfin

    Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. S…

    jellyfin jellyfin