PT-2026-32958 · Jellyfin · Jellyfin

Paul-Gerste-Sonarsource · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-35033

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.11.7

Description An unauthenticated arbitrary file read is possible via ffmpeg argument injection through the query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds lowercase query parameters to a dictionary without validation, bypassing the RegularExpression attribute on the level controller parameter. This unsanitized value is then concatenated directly into the ffmpeg command line. An attacker can inject a drawtext filter with a textfile argument to read arbitrary server files, such as /etc/shadow, and exfiltrate the contents as text rendered in the video stream response. The affected endpoint is '/Videos/{itemId}/stream', which lacks an Authorize attribute, allowing exploitation without authentication, although item GUIDs are pseudorandom.

Recommendations Update to version 10.11.7.

Fix

Argument Injection

Missing Authorization

Weakness Enumeration

CWE-88

CWE-862

Related Identifiers

CVE-2026-35033

Affected Products

Jellyfin

References · 5

• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jh22-fw8w-2v9x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35033 · Security Note
• https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 · Note
• https://twitter.com/CVEnew/status/2044338893508719038 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044238984646131876 · Twitter Post