Executive brief
Jellyfin is an open-source media server used to host and stream movies, shows, and music. A security flaw in the subtitle upload feature allows an authorized user to write files to restricted areas of the server's operating system. This can be used to steal sensitive data, take over administrator accounts, and ultimately gain full control of the server as a root user, potentially leading to a total compromise of the host system and its data.
Technical details
A vulnerability chain exists in the Jellyfin subtitle upload endpoint (POST /Videos/{itemId}/Subtitles) due to improper validation of the 'Format' field. An attacker can use path traversal sequences in the file extension to perform an arbitrary file write. This can be further chained by writing malicious .strm files to achieve arbitrary file read, extracting the database to escalate privileges to administrator, and finally achieving remote code execution (RCE) as root by overwriting /etc/ld.so.preload. Exploitation requires 'Subtitle Management' permissions, which are held by administrators or users specifically granted upload rights. The issue is resolved in version 10.11.7 through improved input sanitization.
Affected products
- Jellyfin Jellyfin < 10.11.7
Timeline
- 2026-03-31: patched: Version 10.11.7 released with security fixes.
- 2026-04-14: disclosed: Security advisory published.
- 2026-04-14: advisory