Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

jellyfin — Vulnerabilities & Security Advisories 16

All 16 CVE vulnerabilities found in jellyfin, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the Jellyfin media server, specifically focusing on software weaknesses and their associated security tags. The collection encompasses a comprehensive range of reported issues, including remote code execution, denial of service, and information disclosure flaws, covering the entire historical timeline from the product's initial release to the present day. Users can utilize this resource to track official vendor advisories, analyze the characteristics of specific weakness classes affecting media streaming applications, or review the complete vulnerability history of the Jellyfin platform to assess long-term security trends. By centralizing these records, the page serves as a technical reference for security professionals and system administrators who need to evaluate risk exposure without navigating fragmented sources. The data presented here is strictly factual, derived from public disclosures and vendor communications, ensuring accuracy for audit and remediation purposes. No specific CVE identifiers are listed in this summary, but the underlying database contains detailed entries for every documented incident. This aggregation supports proactive security management by highlighting recurring patterns and enabling the comparison of fix timelines across different software versions.

Vendor: jellyfin

CVE ID Title CVSS Severity Published
CVE-2026-49220 Jellyfin: Potential XSS in user management CWE-79 5.7 Medium 2026-06-24
CVE-2026-48793 Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path CWE-88 8.8 High 2026-06-24
CVE-2026-49246 Jellyfin: Potential MKV attachment filename path traversal to RCE CWE-22 - - 2026-06-24
CVE-2026-49247 Jellyfin: Potential Authenticated path traversal in /ClientLog/Document CWE-22 8.8 High 2026-06-24
CVE-2026-35034 Jellyfin: Potential Application DoS from excessively large SyncPlay group names CWE-400 6.5 Medium 2026-04-14
CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection CWE-88 7.5 - 2026-04-14
CVE-2026-35032 Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner CWE-918 8.1 - 2026-04-14
CVE-2026-35031 Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain CWE-20 10.0 Critical 2026-04-14
CVE-2025-31499 Jellyfin Vulnerable to Argument Injection in FFmpeg CWE-88 8.8AI High AI 2025-04-15
CVE-2025-32012 Jellyfin Vulnerable to Denial of Service (DoS) via IP Spoofing CWE-290 6.5AI Medium AI 2025-04-15
CVE-2024-43801 Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin CWE-200 4.6 Medium 2024-09-02
CVE-2023-48702 Jellyfin Possible Remote Code Execution via custom FFmpeg binary CWE-77 7.2 High 2023-12-13
CVE-2023-49096 Argument Injection in FFmpeg codec parameters in Jellyfin CWE-88 7.7 High 2023-12-06
CVE-2023-30626 Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution CWE-22 8.8 High 2023-04-24
CVE-2021-29490 Unauthenticated GET requests through Remote Image endpoints CWE-918 5.8 Medium 2021-05-05
CVE-2021-21402 Unauthenticated Arbitrary File Access in Jellyfin CWE-22 7.7 High 2021-03-23

All 16 known CVE vulnerabilities affecting jellyfin with full Chinese analysis, references, and POCs where available.