PT-2026-32957 · Jellyfin · Jellyfin

Gerhardbotha97 + 1 · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-35032

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.11.7

Description A flaw exists in the LiveTV M3U tuner endpoint 'POST /LiveTv/TunerHosts' where the tuner URL is not validated. This allows an authenticated user to perform local file reads via non-HTTP paths and Server-Side Request Forgery (SSRF), which is the ability to induce the server to make requests to an unintended location, via HTTP URLs. Because the EnableLiveTvManagement permission is enabled by default for new users, an attacker can add an M3U tuner pointing to a malicious server. By serving a crafted M3U with a channel pointing to the Jellyfin database, the attacker can exfiltrate the database to extract admin session tokens and escalate privileges to administrator.

Recommendations Update to version 10.11.7. As a temporary workaround, disable Live TV Management privileges for all users.

Fix

SSRF

Weakness Enumeration

CWE-918

CWE-73

Related Identifiers

CVE-2026-35032

Affected Products

Jellyfin

References · 5

• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35032 · Security Note
• https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 · Note
• https://twitter.com/VulmonFeeds/status/2044241544417247740 · Twitter Post
• https://twitter.com/CVEnew/status/2044338894674813304 · Twitter Post