CVE-2026-35031

🗓️ 14 Apr 2026 22:18:30Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 12 Views🌐 WEB

Jellyfin before 10.11.7 allows subtitle upload path traversal causing arbitrary write and root remote code execution.

Reporter	Title	Published	Views	Family All 12
GithubExploit	Exploit for CVE-2026-35031	15 Apr 202620:56	–	githubexploit
ATTACKERKB	CVE-2026-35031	14 Apr 202622:18	–	attackerkb
AlpineLinux	CVE-2026-35031	14 Apr 202622:18	–	alpinelinux
Circl	CVE-2026-35031	15 Apr 202600:57	–	circl
CNNVD	Jellyfin 安全漏洞	14 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-35031 Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain	14 Apr 202622:18	–	cvelist
EUVD	EUVD-2026-22764	14 Apr 202622:18	–	euvd
NVD	CVE-2026-35031	14 Apr 202623:16	–	nvd
Positive Technologies	PT-2026-32956	14 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-35031	16 Apr 202619:22	–	redhatcve

NVD

Vulners

Node

jellyfin jellyfinRange<10.11.7

[
  {
    "vendor": "jellyfin",
    "product": "jellyfin",
    "versions": [
      {
        "version": "< 10.11.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3
github	www.github.com/jellyfin/jellyfin/releases/tag/v10.11.7

Parameter	Position	Path	Description	CWE
Format	request body	/Videos/{itemId}/Subtitles	Path traversal in subtitle upload endpoint allows writing to arbitrary file paths via the unvalidated Format field, enabling potential RCE via /etc/ld.so.preload.	CWE-22
Language	request body	/Videos/{itemId}/Subtitles	Path traversal in subtitle upload endpoint allows writing to arbitrary file paths via the unvalidated Format field, enabling potential RCE via /etc/ld.so.preload.	CWE-22

23 Apr 2026 17:44Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.18.8 - 9.9

EPSS0.00656

SSVC

Jellyfin subtitle upload path traversal arbitrary write remote code execution version 10.11.7