CVE-2026-35032

🗓️ 14 Apr 2026 22:25:35Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 2 Views🌐 WEB

Jellyfin LiveTV M3U tuner enables Server Side Request Forgery and local file read via /LiveTv/TunerHosts, risking admin tokens. Fixed in 10.11.7.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-35032	14 Apr 202622:25	–	attackerkb
Circl	CVE-2026-35032	15 Apr 202600:49	–	circl
CNNVD	Jellyfin 代码问题漏洞	14 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-35032 Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner	14 Apr 202622:25	–	cvelist
EUVD	EUVD-2026-22766	14 Apr 202622:25	–	euvd
NVD	CVE-2026-35032	14 Apr 202623:16	–	nvd
Positive Technologies	PT-2026-32957	14 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-35032	16 Apr 202601:22	–	redhatcve
Snyk	Server-side Request Forgery (SSRF)	14 Apr 202623:11	–	snyk
Snyk	Server-side Request Forgery (SSRF)	14 Apr 202623:11	–	snyk

NVD

Vulners

Node

jellyfin jellyfinRange<10.11.7

[
  {
    "vendor": "jellyfin",
    "product": "jellyfin",
    "versions": [
      {
        "version": "< 10.11.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/jellyfin/jellyfin/releases/tag/v10.11.7
github	www.github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8

Parameter	Position	Path	Description	CWE
tunerUrl	request body	/LiveTv/TunerHosts	Unvalidated tuner URL in POST /LiveTv/TunerHosts enables local file read via non-HTTP paths and SSRF via HTTP URLs.	CWE-918, CWE-73

23 Apr 2026 14:03Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.1

CVSS 48.6

EPSS0.00016

SSVC