PT-2025-5604 · Jellystat · Jellystat

Realarcherl · Published 2025-02-03 · Updated 2025-02-03 · CVE-2025-24960

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Jellystat versions prior to 1.1.3

Description: Jellystat is a free and open source Statistics App for Jellyfin. In affected versions, Jellystat directly uses user input in the routes, which can lead to Path Traversal vulnerabilities. Although this functionality is only for administrators, the DELETE files/:filename command can be used to delete any file. This issue has been addressed in version 1.1.3.

Recommendations: For versions prior to 1.1.3, update to version 1.1.3 to fix the Path Traversal vulnerability. As a temporary workaround, consider restricting access to the DELETE files/:filename command until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-24960

GHSA-6X46-6W9F-FFV6

Affected Products

Jellystat

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24960.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24960 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24960 · Vendor Advisory
• https://github.com/CyferShepard/Jellystat/pull/303 · Note
• https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-6x46-6w9f-ffv6 · Note
• https://twitter.com/CVEnew/status/1886523328401383494 · Twitter Post
• https://twitter.com/CveFindCom/status/1886520295730688473 · Twitter Post
• https://t.me/cvedetector/17133 · Telegram Post
• https://cwe.mitre.org/data/definitions/22.html · Note