Executive brief
Jellyfin is an open-source media server used to manage and stream personal video and audio collections. A security flaw in the Live TV management feature allows any registered user to read sensitive files from the server or trick the server into making unauthorized network requests. In practice, an attacker can use this to steal the server's database, hijack administrator accounts, and take full control of the media server.
Technical details
A vulnerability chain exists in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts) due to insufficient validation of the tuner URL. In M3uParser.cs, the application fails to sanitize input before calling AsyncFile.OpenRead for non-HTTP paths (enabling local file read) or fetching HTTP URLs (enabling SSRF). Because the 'EnableLiveTvManagement' permission defaults to true for new users, any authenticated user can add a malicious M3U tuner. An attacker can point a channel to the 'jellyfin.db' file, stream it to exfiltrate the database, extract admin session tokens, and escalate their privileges to administrator. The issue is resolved in version 10.11.7 by improving endpoint sanitization and changing default user permissions.
Affected products
- Jellyfin Jellyfin < 10.11.7
Timeline
- 2023-03-31: patched: Version 10.11.7 released
- 2026-04-14: advisory: GitHub Security Advisory published
- 2026-04-14: disclosed: CVE-2026-35032 published