PT-2026-32956 · Jellyfin · Jellyfin

Lte · CVE-2026-35031 · Published 2026-04-14 · Updated 2026-05-22

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.11.7

Description A flaw exists in the subtitle upload endpoint '/Videos/{itemId}/Subtitles' where the Format field is not validated. This allows path traversal via the file extension, enabling arbitrary file write. This can be chained to achieve arbitrary file read via .strm files, database extraction, admin privilege escalation, and remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user explicitly granted the Upload Subtitles permission.

Recommendations Update to version 10.11.7. Restrict the Upload Subtitles permission for non-administrator users to reduce the attack surface.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-187

CWE-22

CWE-20

Related Identifiers

CVE-2026-35031

GHSA-J2HF-X4Q5-47J3

Affected Products

Jellyfin

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35031.json · Exploit
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35031 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35031 · Vendor Advisory
• https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 · Note
• https://t.me/defcon_news/135886 · Telegram Post
• https://twitter.com/ctiwatchcloud/status/2044385465436926035 · Twitter Post
• https://twitter.com/0dayPublishing/status/2044788069363073100 · Twitter Post
• https://twitter.com/CVEnew/status/2044338895815676173 · Twitter Post
• https://twitter.com/keraattin/status/2044564295086706863 · Twitter Post