Jellyfin (<= 12.4)

Jellyfin versions up to 12.4 contain an SSRF vulnerability where authenticated users can bypass image validation by submitting gzip-compressed SVG payloads in data URIs to interact with internal network resources or read local files.