Skip to content
OpenAdvisories

Vendor

jellyfin

22 known vulnerabilities.

Products

jellyfin 20 jellyfin-web 1 code-quality.yml 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-119551

    Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

    Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeated…

    jellyfin jellyfin jellyfin Wolfi
  • Medium 5.7
    CVE-2026-49220

    Jellyfin: Potential XSS in user management

    Jellyfin is an open source self hosted media server. Prior to 10.11.9, a potential XSS attack exists in Jellyfin which can allow a non-privileged user to execute arbitrary Javascript in the context of a logged-in Administrative user, resulting in numerous pot…

    jellyfin jellyfin
  • Medium 6.5
    CVE-2026-35034

    Jellyfin: Potential Application DoS from excessively large SyncPlay group names

    Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a denial of service vulnerability in the SyncPlay group creation endpoint (POST /SyncPlay/New), where an authenticated user can create groups with names of unlimited size d…

    jellyfin jellyfin
  • Medium 4.6
    CVE-2025-32012

    Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing

    Jellyfin is an open source self hosted media server. In versions 10.9.0 to before 10.10.7, the /System/Restart endpoint provides administrators the ability to restart their Jellyfin server. This endpoint is intended to be admins-only, but it also authorizes r…

    jellyfin jellyfin
  • Medium 4.6
    CVE-2024-43801

    Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin

    Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of the Jellyfin W…

    jellyfin jellyfin jellyfin Wolfi
  • Medium 5.8
    CVE-2021-29490 Scanner template EPSS 70%

    Unauthenticated GET requests through Remote Image endpoints

    Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue…

    jellyfin jellyfin