Description
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jellyfin | jellyfin | ≤ 12.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jellyfin | No fix yet | — |
References
- https://github.com/jellyfin/jellyfin/blob/v12.4/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs#L169-L173 technical-description
- https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/ImageController.cs#L96 technical-description
- GitHub Security Advisory (GHSA-cf3c-8m59-2vhx) related vendor-advisory
- https://abraxaslabs.tech/research/jellyfin-svg-gzip third-party-advisory
- https://github.com/jellyfin/jellyfin product
- VulnCheck Advisory: Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images third-party-advisory