PT-2025-50221 · Emby · Emby Server

Published 2025-12-06 · Updated 2025-12-11 · CVE-2025-64113

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Emby Server versions prior to 4.9.1.81 Emby Server versions 4.9.1.81 through 4.9.1.90 Emby Server version 4.9.2.7

Description Emby Server, a user-installable home media server, is affected by an issue allowing an attacker to gain full administrative access to the server. No specific preconditions beyond network access are required for exploitation. Approximately 993.8k servers are estimated to be exposed. The issue affects Emby Server administration, not the underlying operating system.

Recommendations Update Emby Server to version 4.9.1.81 or later. Update Emby Server to version 4.9.1.90 or later. Update Emby Server to version 4.9.2.7 or later.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

BDU:2026-05171

CVE-2025-64113

GHSA-95FV-5GFJ-2R84

Affected Products

Emby Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64113.json · Exploit
• https://github.com/EmbySupport/Emby.Security/security/advisories/GHSA-95fv-5gfj-2r84 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64113 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64113 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05171 · Security Note
• https://twitter.com/CVEnew/status/1998732825684795697 · Twitter Post
• https://twitter.com/0dayPublishing/status/1998477838966497781 · Twitter Post
• https://twitter.com/zoomeye_team/status/1998643504231174395 · Twitter Post
• https://reddit.com/r/emby/comments/1pjiy52/update_your_servers_api_vulnerability_allowing_to · Reddit Post