CVE-2026-49246 Details
Description
Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exploit missing path sanitization during playback. Jellyfin treats the MKV file name tag on MKV attachments as trusted and passes it unsanitized into Path.Combine(attachmentFolder, fileName) inside PathManager.GetAttachmentPath. Because .NET's Path.Combine neither normalises .. nor rejects a rooted second argument, a crafted MKV can redirect Jellyfin's MKV attachment extraction to any absolute path on disk. This triggers on any playback action of the affected video on a client which will attempt to burn in the subtitles by default.g This vulnerability is fixed in 10.11.10.
A path traversal vulnerability allowing remote code execution has been identified in Jellyfin versions prior to 10.11.10. The issue arises from the media server's handling of MKV files with forged filename tags. During playback, Jellyfin fails to properly sanitize these tags, treating them as trusted and passing them unsanitized into the path management system. This oversight allows a crafted MKV file to manipulate the extraction path of MKV attachments, redirecting it to any absolute location on the server's disk. The vulnerability is triggered automatically when the affected video is played, as Jellyfin by default burns in subtitles.
Users can upgrade to Jellyfin version 10.11.10 or later to address this vulnerability. It is also recommended to practice good hygiene when handling media files from untrusted sources, including checking for suspicious filename tags.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jellyfin/jellyfin/security/advisories/GHSA-f47c-m7gr-q92j | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jellyfin | < 10.11.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |