CVE-2026-49247

Name of the Vulnerable Software and Affected Versions Jellyfin versions 10.9.0 through 10.11.9

Description The POST '/ClientLog/Document' endpoint fails to sanitize the Client and Version fields within the Authorization header when saving client-uploaded log documents to the disk. An authenticated non-admin user can exploit this by inserting path traversal sequences (../) into the Client field, allowing the application to write attacker-controlled content to arbitrary paths accessible by the service user, although the files are forced to have a .log suffix.

Recommendations Update to version 10.11.10.