PT-2026-34561 · Cyfershepard · Jellystat

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-41167

NVD

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via POST /api/getUserDetails and POST /api/getLibrary, enabling full read of any table in the database - including app config, which stores the Jellystat admin credentials, the Jellyfin API key, and the Jellyfin host URL. Because the vulnerable call site dispatches via node-postgres's simple query protocol (no parameter array is passed), stacked queries are allowed, which escalates the injection from data disclosure to arbitrary command execution on the PostgreSQL host via COPY ... TO PROGRAM. Under the role shipped by the project's docker-compose.yml (a PostgreSQL superuser), no additional privileges are required to reach the RCE primitive. Version 1.1.10 contains a fix.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-41167

Affected Products

Jellystat

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-41167 · Security Note
• https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-fj7c-2p5q-g56m · Note
• https://github.com/CyferShepard/Jellystat/commit/735fe7c6eb0e3e34e92a8a82fd21914d76693665 · Note