PT-2026-52066 · Jellyfin · Jellyfin
CVE-2026-49246
·
Published
2026-06-24
·
Updated
2026-06-25
CVSS v4.0
1.7
Low
| Vector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U |
Name of the Vulnerable Software and Affected Versions
Jellyfin versions prior to 10.11.10
Description
Missing path sanitization during playback allows the use of a specially crafted MKV file with forged filename tags to redirect attachment extraction to any absolute path on the disk. This occurs because the software treats the MKV file name tag on attachments as trusted and passes it unsanitized into the
Path.Combine(attachmentFolder, fileName) method within the PathManager.GetAttachmentPath() function. The issue is triggered when a client attempts to burn in subtitles during the playback of the affected video.Recommendations
Update to version 10.11.10.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jellyfin