Jellyfin (<= 12.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/jellyfin--12.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 13:29:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJellyfin: Server-side request forgery in UserImage (CVE-2026-119549)https://feed.craftedsignal.io/briefs/2026-10-jellyfin-ssrf/Fri, 30 Oct 2026 13:29:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-jellyfin-ssrf/Jellyfin versions up to 12.4 contain an SSRF vulnerability where authenticated users can bypass image validation by submitting gzip-compressed SVG payloads in data URIs to interact with internal network resources or read local files.Jellyfin versions through 12.4 are vulnerable to a Server-Side Request Forgery (SSRF) flaw in the image processing pipeline. An authenticated attacker can bypass the SvgSecurityValidator by embedding gzip-compressed SVG content into non-SVG image data URIs. By uploading a crafted image to the '/UserImage' POST endpoint and triggering a GET request to the same endpoint, the server can be coerced into accessing unauthorized internal network resources or reading local files. The vulnerability can also be leveraged to trigger memory exhaustion on the host system.

Impact

Successful exploitation allows an authenticated user to perform unauthorized internal network scanning, potentially read local image files on the server, or cause a denial-of-service state through memory exhaustion.

Recommendation

  • Update Jellyfin to a patched version beyond 12.4 once available.
  • Until an update is deployed, monitor '/UserImage' endpoints for anomalous POST requests from standard user accounts.
  • Restrict access to the Jellyfin instance to trusted networks to mitigate the impact of internal SSRF probes.
]]>mediumadvisoryweb-applicationssrfvulnerability