{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jellyfin--12.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-126499"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Jellyfin (\u003c 12.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Jellyfin"],"content_html":"\u003cp\u003eJellyfin versions before 12.0 are affected by a path traversal vulnerability in the 'DELETE /Library/VirtualFolders' and 'POST /Library/VirtualFolders/Name' endpoints. This flaw allows attackers, particularly during the initial setup phase, to supply path traversal sequences (e.g., '..') or absolute paths as library names. Successful exploitation results in the unauthorized deletion or movement of critical application data, including the 'jellyfin.db' database and the entire application data directory.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to perform arbitrary file system operations, leading to potential data loss or denial of service by destroying the application database and configuration environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Jellyfin to version 12.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing library configurations for suspicious or non-standard naming conventions if the instance was exposed during setup.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the Jellyfin API, especially during initial instance initialization, to trusted management networks only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T05:59:54Z","date_published":"2026-11-11T05:59:54Z","id":"https://feed.craftedsignal.io/briefs/2026-11-jellyfin-path-traversal/","summary":"Jellyfin versions prior to 12.0 contain a path traversal vulnerability in API endpoints that allows unauthenticated attackers to delete or move arbitrary directories by manipulating library names.","title":"Jellyfin: Path traversal vulnerability (CVE-2026-126499)","url":"https://feed.craftedsignal.io/briefs/2026-11-jellyfin-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Jellyfin (\u003c 12.0)","version":"https://jsonfeed.org/version/1.1"}