CVE-2026-41167 Details
Description
Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via `POST /api/getUserDetails` and `POST /api/getLibrary`, enabling full read of any table in the database - including `app_config`, which stores the Jellystat admin credentials, the Jellyfin API key, and the Jellyfin host URL. Because the vulnerable call site dispatches via `node-postgres`'s simple query protocol (no parameter array is passed), stacked queries are allowed, which escalates the injection from data disclosure to arbitrary command execution on the PostgreSQL host via `COPY ... TO PROGRAM`. Under the role shipped by the project's `docker-compose.yml` (a PostgreSQL superuser), no additional privileges are required to reach the RCE primitive. Version 1.1.10 contains a fix.
A critical SQL injection vulnerability has been identified in Jellystat, a statistics application for Jellyfin, in versions prior to 1.1.10. The vulnerability exists in multiple API endpoints that construct SQL queries by directly inserting unsanitized request-body data into raw SQL strings. This flaw allows an authenticated user to inject arbitrary SQL through the 'POST /api/getUserDetails' and 'POST /api/getLibrary' endpoints. Exploitation of this vulnerability could lead to unauthorized access to sensitive data, including admin credentials and API keys, and could be escalated to arbitrary command execution on the PostgreSQL host.
Users are advised to update to Jellystat version 1.1.10, where this vulnerability has been fixed. Additionally, review and update the database role privileges in the 'docker-compose.yml' file to prevent the 'COPY ... TO PROGRAM' execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 22, 2026CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-fj7c-2p5q-g56m | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/CyferShepard/Jellystat/commit/735fe7c6eb0e3e34e92a8a82fd21914d76693665 | [email protected] | Source CodeVendor |
| https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-fj7c-2p5q-g56m | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CyferShepard Jellystat | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |