PT-2021-14479 · Jellyfin · Jellyfin

Joshuaboniface · Published 2021-03-23 · Updated 2025-08-28 · CVE-2021-21402

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.7.1

Description The issue allows arbitrary file read from a Jellyfin server's file system with well-crafted requests to certain "API Endpoints". This is more prevalent when Windows is used as the host OS. Servers exposed to the public Internet are potentially at risk.

Recommendations For versions prior to 10.7.1, update to version 10.7.1 as soon as possible. As a temporary workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-21402

GHSA-WG4C-C9G9-RXHX

Affected Products

Jellyfin

References · 10

• 🔥❌ https://github.com/MzzdToT/CVE-2021-21402 · Exploit, Deleted
• https://github.com/jellyfin/jellyfin/commit/0183ef8e89195f420c48d2600bc0b72f6d3a7fd7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21402 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21402 · Vendor Advisory
• https://github.com/jellyfin/jellyfin/releases/tag/v10.7.1 · Note
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wg4c-c9g9-rxhx · Note
• https://twitter.com/Lulz_BinBash/status/1961110746148081762 · Twitter Post
• https://t.me/cibsecurity/25345 · Telegram Post
• https://t.me/cybersecuritytechnologies/3104 · Telegram Post
• https://t.me/cybersecuritytechnologies/3064 · Telegram Post