CVE-2026-35033

🗓️ 14 Apr 2026 22:28:47Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 2 Views🌐 WEB

Jellyfin before 10.11.7 allows arbitrary file read via ffmpeg stream option injection.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-35033	14 Apr 202622:28	–	attackerkb
Circl	CVE-2026-35033	15 Apr 202600:43	–	circl
CNNVD	Jellyfin 安全漏洞	14 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection	14 Apr 202622:28	–	cvelist
EUVD	EUVD-2026-22768	14 Apr 202622:28	–	euvd
NVD	CVE-2026-35033	14 Apr 202623:16	–	nvd
Positive Technologies	PT-2026-32958	14 Apr 202600:00	–	ptsecurity
Snyk	Arbitrary Argument Injection	14 Apr 202623:11	–	snyk
Vulnrichment	CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection	14 Apr 202622:28	–	vulnrichment

NVD

Vulners

Node

jellyfin jellyfinRange<10.11.7

[
  {
    "vendor": "jellyfin",
    "product": "jellyfin",
    "versions": [
      {
        "version": "< 10.11.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/jellyfin/jellyfin/security/advisories/GHSA-jh22-fw8w-2v9x
github	www.github.com/jellyfin/jellyfin/releases/tag/v10.11.7

Parameter	Position	Path	Description	CWE
StreamOptions	query param	/Videos/{itemId}/stream	Unauthenticated arbitrary file read via injection of unsanitized StreamOptions query parameter into ffmpeg command, allowing reading server files (e.g., /etc/shadow) through a crafted drawtext filter.	CWE-862, CWE-88

23 Apr 2026 14:02Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.19.1

CVSS 49.3

EPSS0.0011

SSVC