Jellyfin (< 12.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/jellyfin--12.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 05:59:54 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJellyfin: Path traversal vulnerability (CVE-2026-126499)https://feed.craftedsignal.io/briefs/2026-11-jellyfin-path-traversal/Wed, 11 Nov 2026 05:59:54 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-jellyfin-path-traversal/Jellyfin versions prior to 12.0 contain a path traversal vulnerability in API endpoints that allows unauthenticated attackers to delete or move arbitrary directories by manipulating library names.Jellyfin versions before 12.0 are affected by a path traversal vulnerability in the 'DELETE /Library/VirtualFolders' and 'POST /Library/VirtualFolders/Name' endpoints. This flaw allows attackers, particularly during the initial setup phase, to supply path traversal sequences (e.g., '..') or absolute paths as library names. Successful exploitation results in the unauthorized deletion or movement of critical application data, including the 'jellyfin.db' database and the entire application data directory.

Impact

Successful exploitation allows unauthenticated attackers to perform arbitrary file system operations, leading to potential data loss or denial of service by destroying the application database and configuration environment.

Recommendation

  • Upgrade Jellyfin to version 12.0 or later immediately.
  • Audit existing library configurations for suspicious or non-standard naming conventions if the instance was exposed during setup.
  • Restrict network access to the Jellyfin API, especially during initial instance initialization, to trusted management networks only.
]]>highadvisory