{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jellyfin--12.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-119549"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Jellyfin (\u003c= 12.4)"],"_cs_severities":["medium"],"_cs_tags":["web-application","ssrf","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Jellyfin"],"content_html":"\u003cp\u003eJellyfin versions through 12.4 are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the image processing pipeline. An authenticated attacker can bypass the SvgSecurityValidator by embedding gzip-compressed SVG content into non-SVG image data URIs. By uploading a crafted image to the '/UserImage' POST endpoint and triggering a GET request to the same endpoint, the server can be coerced into accessing unauthorized internal network resources or reading local files. The vulnerability can also be leveraged to trigger memory exhaustion on the host system.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to perform unauthorized internal network scanning, potentially read local image files on the server, or cause a denial-of-service state through memory exhaustion.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Jellyfin to a patched version beyond 12.4 once available.\u003c/li\u003e\n\u003cli\u003eUntil an update is deployed, monitor '/UserImage' endpoints for anomalous POST requests from standard user accounts.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Jellyfin instance to trusted networks to mitigate the impact of internal SSRF probes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T13:29:45Z","date_published":"2026-10-30T13:29:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jellyfin-ssrf/","summary":"Jellyfin versions up to 12.4 contain an SSRF vulnerability where authenticated users can bypass image validation by submitting gzip-compressed SVG payloads in data URIs to interact with internal network resources or read local files.","title":"Jellyfin: Server-side request forgery in UserImage (CVE-2026-119549)","url":"https://feed.craftedsignal.io/briefs/2026-10-jellyfin-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Jellyfin (\u003c= 12.4)","version":"https://jsonfeed.org/version/1.1"}