# CVE-2026-126499: Jellyfin path traversal in virtual folder endpoints

Source: https://junglewise.ai/threats/cve-2026-126499-jellyfin-before-12-0-contains-a-path-traversal-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-126499 · Severity: high · CVSS 7.4 · Published 2026-11-11

Jellyfin is a media streaming server that stores user libraries and configuration in a database. Before version 12.0, its folder management endpoints fail to validate library names, allowing attackers to delete or move arbitrary directories including the main database. During initial setup when authentication is not yet required, an attacker can completely destroy the server by supplying paths like ".." or absolute paths.

Technologies: [Jellyfin](https://junglewise.ai/threats/technologies/jellyfin). Vendors: [Jellyfin](https://junglewise.ai/threats/vendors/jellyfin).

## Quick answers

**Is CVE-2026-126499 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126499 being exploited in the wild.

**How severe is CVE-2026-126499?** High severity, with a CVSS score of 7.4, published 11 November 2026.

**Which products and versions are affected?** Jellyfin before 12.0.

**Is there a fix for CVE-2026-126499?** Yes: fixed in Jellyfin 12.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126499 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-126499?** Check whether you run Jellyfin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Jellyfin 12.0

## Technical details

A path traversal vulnerability exists in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints due to insufficient validation of the library name parameter. An unauthenticated attacker can supply directory traversal sequences (../) or absolute paths before setup completes to recursively delete arbitrary directories, including the data directory and jellyfin.db database file. The vulnerability requires the attacker to reach the API before authentication is configured.

## Affected products

- Jellyfin Jellyfin before 12.0

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs](https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs)
- [https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs](https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs)

## Related threats

- [Jellyfin authorization bypass in SuggestionsController.GetSuggestions](https://junglewise.ai/threats/cve-2026-119551-jellyfin-through-12-4-contains-an-authorization-bypass)
- [Jellyfin server-side request forgery in SvgSecurityValidator](https://junglewise.ai/threats/cve-2026-119549-jellyfin-through-12-4-contains-a-server-side-request-forgery)
- [Jellyfin path traversal in ClientLog Document endpoint](https://junglewise.ai/threats/cve-2026-49247-jellyfin-path-traversal-in-clientlog-document-endpoint)
- [Jellyfin path traversal in MKV attachment extraction](https://junglewise.ai/threats/cve-2026-49246-jellyfin-path-traversal-in-mkv-attachment-extraction)
- [Jellyfin stored XSS in user management dashboard via Client header](https://junglewise.ai/threats/cve-2026-49220-jellyfin-stored-xss-in-user-management-dashboard-via-client)