CVE-2026-35031 Details
Description
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface.
A critical vulnerability chain has been identified in Jellyfin versions prior to 10.11.7, allowing a user with the 'Upload Subtitles' permission to execute remote code as root. The issue arises in the subtitle upload endpoint, where the Format field is not properly validated. This lack of validation enables path traversal through the file extension, leading to arbitrary file writes. Exploitation of this arbitrary file write can be combined with .strm files to read arbitrary files, extract database information, escalate privileges to admin, and ultimately execute code remotely as root using ld.so.preload.
Users are advised to upgrade to Jellyfin version 10.11.7. If an immediate upgrade is not possible, non-administrator users should not be granted subtitle upload permissions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 | [email protected] | ProductRelease Notes |
| https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-187 | Partial String Comparison | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jellyfin jellyfin | < 10.11.7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | New CVE Received | [email protected] |