CVE-2026-35032

🗓️ 14 Apr 2026 22:25:35Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

Jellyfin LiveTV M3U tuner enables Server Side Request Forgery and local file read via /LiveTv/TunerHosts, risking admin tokens. Fixed in 10.11.7.

Reporter	Title	Published	Views	Family All 13
attackerkb	CVE-2026-35032	14 Apr 202622:25	–	attackerkb
Circl	CVE-2026-35032	15 Apr 202600:49	–	circl
CNNVD	Jellyfin code issues and vulnerabilities	14 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-35032 Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner	14 Apr 202622:25	–	cvelist
EUVD	EUVD-2026-22766	14 Apr 202622:25	–	euvd
Mend	CVE-2026-35032	14 Apr 202622:25	–	mend
NVD	CVE-2026-35032	14 Apr 202623:16	–	nvd
Positive Technologies	PT-2026-32957	14 Apr 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-35032: Server-Side Request Forgery (SSRF)	14 Apr 202600:00	–	rapid7
RedhatCVE	CVE-2026-35032	16 Apr 202601:22	–	redhatcve

NVD

Vulners

Node

jellyfin jellyfinRange<10.11.7

[
  {
    "vendor": "jellyfin",
    "product": "jellyfin",
    "versions": [
      {
        "version": "< 10.11.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8
github	www.github.com/jellyfin/jellyfin/releases/tag/v10.11.7

Parameter	Position	Path	Description	CWE
tuner URL	request body	/LiveTv/TunerHosts	The tuner URL in the LiveTV M3U tuner endpoint is not validated, allowing for Server-Side Request Forgery (SSRF) via HTTP URLs and local file read via non-HTTP paths.	CWE-73, CWE-918

24 Jul 2026 21:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.1

CVSS 48.6

EPSS0.00312

SSVC