Description
Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jellyfin | jellyfin | < 12.0 | 12.0 |
References
- GitHub Security Advisory (GHSA-6828-c7cx-hvqm) vendor-advisory
- https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e patch
- Jellyfin v12.0 Release Notes release-notes
- https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs#L127-L176 technical-description
- https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs#L3255-L3275 technical-description
- VulnCheck Advisory: Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints third-party-advisory