Jellyfin (< 12.0)

Jellyfin versions prior to 12.0 contain a path traversal vulnerability in API endpoints that allows unauthenticated attackers to delete or move arbitrary directories by manipulating library names.