PT-2025-5604 · Jellystat · Jellystat

Realarcherl · Publicado 2025-02-03 · Atualizado 2025-02-03 · CVE-2025-24960

Positive Technologies (AI Summary)

CVSS v3.1

8.7

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Jellystat versions prior to 1.1.3

Description: Jellystat is a free and open source Statistics App for Jellyfin. In affected versions, Jellystat directly uses user input in the routes, which can lead to Path Traversal vulnerabilities. Although this functionality is only for administrators, the DELETE files/:filename command can be used to delete any file. This issue has been addressed in version 1.1.3.

Recommendations: For versions prior to 1.1.3, update to version 1.1.3 to fix the Path Traversal vulnerability. As a temporary workaround, consider restricting access to the DELETE files/:filename command until the update is applied.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2025-24960

GHSA-6X46-6W9F-FFV6

Produtos afetados

Jellystat

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24960.json · Exploit
• https://github.com/CyferShepard/Jellystat/pull/303 · Nota
• https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-6x46-6w9f-ffv6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-24960 · Nota de Segurança
• https://twitter.com/CVEnew/status/1886523328401383494 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-24960 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/1886520295730688473 · Publicação no Twitter
• https://t.me/cvedetector/17133 · Publicação no Telegram
• https://cwe.mitre.org/data/definitions/22.html · Nota