Jellyfin: Path traversal vulnerability (CVE-2026-126499)

Jellyfin versions before 12.0 are affected by a path traversal vulnerability in the 'DELETE /Library/VirtualFolders' and 'POST /Library/VirtualFolders/Name' endpoints. This flaw allows attackers, particularly during the initial setup phase, to supply path traversal sequences (e.g., '..') or absolute paths as library names. Successful exploitation results in the unauthorized deletion or movement of critical application data, including the 'jellyfin.db' database and the entire application data directory.

Impact

Successful exploitation allows unauthenticated attackers to perform arbitrary file system operations, leading to potential data loss or denial of service by destroying the application database and configuration environment.

Recommendation

• Upgrade Jellyfin to version 12.0 or later immediately.
• Audit existing library configurations for suspicious or non-standard naming conventions if the instance was exposed during setup.
• Restrict network access to the Jellyfin API, especially during initial instance initialization, to trusted management networks only.