CVE-2026-35033 Details

A vulnerability in Jellyfin versions prior to 10.11.7 allows unauthenticated users to read arbitrary files from the server. This is achieved through ffmpeg argument injection via the StreamOptions query parameter. The vulnerability arises because the ParseStreamOptions method in StreamingHelpers.cs adds lowercase query parameters to a dictionary without proper validation, bypassing the RegularExpression attribute on the level controller parameter. The unsanitized value is then directly concatenated into the ffmpeg command line. By injecting a drawtext filter with a textfile argument, an attacker can access sensitive files like /etc/shadow and exfiltrate their contents as text rendered in the video stream response. The exploitation is possible on the /Videos/{itemId}/stream endpoint, which lacks authentication requirements, although item GUIDs are pseudorandom and need to be obtained by an authenticated user.

Users are advised to upgrade to Jellyfin version 10.11.7 or later, where this vulnerability has been fixed.