PT-2025-16473 · Jellyfin+1 · Jellyfin+1

Freethestack · Published 2025-04-15 · Updated 2025-04-15 · CVE-2025-31499

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.10.7

Description Jellyfin is an open source self-hosted media server. The issue concerns argument injection in FFmpeg, which can potentially lead to remote code execution by anyone with credentials to a low-privileged user. This is achievable through unauthenticated endpoints such as "/Videos//stream" and "/Videos//stream.", and possibly similar endpoints in AudioController. A valid itemId is required for exploitation, but any authenticated attacker could easily retrieve a valid itemId. The vulnerability allows for arbitrary file write, leading to possible remote code execution through the plugin system.

Recommendations For versions prior to 10.10.7, update to version 10.10.7 to resolve the issue. As a temporary workaround, consider restricting access to the unauthenticated endpoints "/Videos//stream" and "/Videos//stream." until the update is applied. Additionally, limiting the ability to retrieve valid itemId values can help minimize the risk of exploitation.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2025-31499

GHSA-2C3C-R7GP-Q32M

Affected Products

Ffmpeg

Jellyfin

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31499.json · Exploit
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-2c3c-r7gp-q32m · Vendor Advisory
• https://github.com/jellyfin/jellyfin/commit/79f3ce53257c5291887cd52d8ac735b5252c9a97 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-31499 · Security Note
• https://osv.dev/vulnerability/CVE-2025-31499 · Vendor Advisory
• https://t.me/cvetracker/21676 · Telegram Post
• https://twitter.com/CVEnew/status/1912247269874929898 · Twitter Post