Quick answers
- Is CVE-2026-49246 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49246 being exploited in the wild.
- How severe is CVE-2026-49246?
- Informational severity, with a CVSS score of 1.7, published 24 June 2026.
- Which products and versions are affected?
- Jellyfin < 10.11.10.
- Is there a fix for CVE-2026-49246?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-49246 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-49246?
- Check whether you run Jellyfin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability exists in Jellyfin's MKV attachment extraction logic within PathManager.GetAttachmentPath. The application treats the filename tag within MKV attachments as trusted, passing it unsanitized to .NET's Path.Combine method. Because Path.Combine does not normalize '..' sequences or reject rooted second arguments, a malicious MKV file can redirect file extraction to arbitrary absolute paths on the host disk. The exploit is triggered automatically when a client attempts to play the video, as the server tries to extract attachments (such as subtitles). This issue is resolved in version 10.11.10.
Affected products
- Jellyfin Jellyfin < 10.11.10
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD