CVE-2026-35032 Details
Description
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. This is exploitable by any authenticated user because the EnableLiveTvManagement permission defaults to true for all new users. An attacker can chain these vulnerabilities by adding an M3U tuner pointing to an attacker-controlled server, serving a crafted M3U with a channel pointing to the Jellyfin database, exfiltrating the database to extract admin session tokens, and escalating to admin privileges. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can disable Live TV Management privileges for all users.
A vulnerability chain has been identified in Jellyfin versions prior to 10.11.7, specifically within the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts). The issue arises because the tuner URL is not properly validated, which enables local file reading through non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. This vulnerability can be exploited by any authenticated user, as the 'EnableLiveTvManagement' permission is enabled by default for all new users. An attacker could exploit this by adding an M3U tuner that points to a server they control, which serves a crafted M3U file containing a channel linked to the Jellyfin database. Streaming this channel could exfiltrate the database, allowing the extraction of admin session tokens that could be used to escalate privileges to admin.
Users are advised to upgrade to Jellyfin version 10.11.7 or later. If an immediate upgrade is not possible, Live TV Management privileges can be disabled for all users.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 | [email protected] | ProductRelease Notes |
| https://github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jellyfin jellyfin | < 10.11.7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 14, 2026 | New CVE Received | [email protected] |