CVE-2026-49246— Jellyfin: Potential MKV attachment filename path traversal to RCE
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49246
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Jellyfin: Potential MKV attachment filename path traversal to RCE
Source: NVD (National Vulnerability Database)
Vulnerability Description
Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exploit missing path sanitization during playback. Jellyfin treats the MKV file name tag on MKV attachments as trusted and passes it unsanitized into Path.Combine(attachmentFolder, fileName) inside PathManager.GetAttachmentPath. Because .NET's Path.Combine neither normalises .. nor rejects a rooted second argument, a crafted MKV can redirect Jellyfin's MKV attachment extraction to any absolute path on disk. This triggers on any playback action of the affected video on a client which will attempt to burn in the subtitles by default.g This vulnerability is fixed in 10.11.10.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-49246
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49246
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49246 (1)
Same Patch Batch · jellyfin · 2026-06-24 · 4 CVEs total
| CVE-2026-48793 | 8.8 HIGH | Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path |
| CVE-2026-49247 | 8.8 HIGH | Jellyfin: Potential Authenticated path traversal in /ClientLog/Document |
| CVE-2026-49220 | 5.7 MEDIUM | Jellyfin: Potential XSS in user management |
IV. Related Vulnerabilities
Same product: jellyfin
- CVE-2026-49220
Jellyfin: Potential XSS in user management - CVE-2026-48793
Jellyfin: Potential FFmpeg argument injection via unescaped - CVE-2026-49247
Jellyfin: Potential Authenticated path traversal in /ClientL - CVE-2026-35034
Jellyfin: Potential Application DoS from excessively large S - CVE-2026-35033
Jellyfin: Potential SSRF + Arbitrary file read via stream ar
Same vendor: jellyfin
- CVE-2026-49220
Jellyfin: Potential XSS in user management - CVE-2026-48793
Jellyfin: Potential FFmpeg argument injection via unescaped - CVE-2026-49247
Jellyfin: Potential Authenticated path traversal in /ClientL - CVE-2026-35034
Jellyfin: Potential Application DoS from excessively large S - CVE-2026-35033
Jellyfin: Potential SSRF + Arbitrary file read via stream ar
Same weakness: CWE-22
- CVE-2026-13369
Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbit - CVE-2026-9145
Database for Contact Form 7, WPforms, Elementor forms <= 1.5 - CVE-2026-13251
Perfmatters <= 2.6.4 - Unauthenticated Arbitrary File Read v - CVE-2026-14439
Path Traversal in Altium Git Service Allows Remote Code Exec - CVE-2026-49119
Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()
V. Comments for CVE-2026-49246
No comments yet