CVE-2026-126499

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 12.0

Description A path traversal issue exists where unvalidated library names allow attackers to delete or move directories. Unauthenticated attackers can exploit this before the setup process is completed by providing absolute paths or sequences like .. to recursively delete the jellyfin.db file and the data directory. This affects the 'DELETE /Library/VirtualFolders' and 'POST /Library/VirtualFolders/Name' API endpoints.

Recommendations Update to version 12.0 or later. Restrict access to the 'DELETE /Library/VirtualFolders' and 'POST /Library/VirtualFolders/Name' endpoints until the update is applied.