Jellyfin: Server-side request forgery in UserImage (CVE-2026-119549)

Jellyfin versions through 12.4 are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the image processing pipeline. An authenticated attacker can bypass the SvgSecurityValidator by embedding gzip-compressed SVG content into non-SVG image data URIs. By uploading a crafted image to the '/UserImage' POST endpoint and triggering a GET request to the same endpoint, the server can be coerced into accessing unauthorized internal network resources or reading local files. The vulnerability can also be leveraged to trigger memory exhaustion on the host system.

Impact

Successful exploitation allows an authenticated user to perform unauthorized internal network scanning, potentially read local image files on the server, or cause a denial-of-service state through memory exhaustion.

Recommendation

• Update Jellyfin to a patched version beyond 12.4 once available.
• Until an update is deployed, monitor '/UserImage' endpoints for anomalous POST requests from standard user accounts.
• Restrict access to the Jellyfin instance to trusted networks to mitigate the impact of internal SSRF probes.