CVE-2026-126499— Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints

Quick assessment

Affected

jellyfin jellyfin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

12.0 版本之前的 Jellyfin 在和端点中存在路径遍历漏洞。该漏洞允许攻击者通过未经验证的库名称来删除或移动目录。在系统完成初始设置之前，未认证的攻击者可以提交诸如或绝对路径等名称，从而递归删除数据目录和数据库文件。

CVSS 7.4 · High Updated Nov 11, 2026

Possible ATT&CK Techniques 2 AI

T1083 · File and Directory Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
jellyfin	jellyfin	0 ~ 12.0	-

II. Public POCs for CVE-2026-126499

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126499

请登录查看更多情报信息。

Other References for CVE-2026-126499 (6)

https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e patch
https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs#L3255-L3275 technical-description
https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs#L127-L176 technical-description
https://github.com/jellyfin/jellyfin/releases/tag/v12.0 release-notes
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm vendor-advisory
https://www.vulncheck.com/advisories/jellyfin-before-12.0-path-traversal-via-library-virtualfolders-endpoints third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126499

IV. Related Vulnerabilities

Same product: jellyfin

Same vendor: jellyfin

Same weakness: CWE-22