Skip to content
OpenAdvisories

Vendor

jellyfin

22 known vulnerabilities.

Products

jellyfin 20 jellyfin-web 1 code-quality.yml 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.5
    CVE-2026-119550

    Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}

    Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUID…

    jellyfin jellyfin jellyfin Wolfi
  • Low 1.7
    CVE-2026-49246

    Jellyfin: Potential MKV attachment filename path traversal to RCE

    Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exploit missing path sanitization during playback. Jellyfin treats the MKV file name tag on MKV attachm…

    jellyfin jellyfin