CVE-2026-35033

🗓️ 14 Apr 2026 22:28:47Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 99 Views🌐 WEB

Jellyfin before 10.11.7 allows arbitrary file read via ffmpeg stream option injection.

Reporter	Title	Published	Views	Family All 12
attackerkb	CVE-2026-35033	14 Apr 202622:28	–	attackerkb
Circl	CVE-2026-35033	15 Apr 202600:43	–	circl
CNNVD	Jellyfin 安全漏洞	14 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection	14 Apr 202622:28	–	cvelist
EUVD	EUVD-2026-22768	14 Apr 202622:28	–	euvd
Mend	CVE-2026-35033	14 Apr 202622:28	–	mend
NVD	CVE-2026-35033	14 Apr 202623:16	–	nvd
Positive Technologies	PT-2026-32958	14 Apr 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-35033: Improper Neutralization of Argument Delimiters in a Command	14 Apr 202600:00	–	rapid7
RedhatCVE	CVE-2026-35033	5 Jun 202619:09	–	redhatcve

NVD

Vulners

Node

jellyfin jellyfinRange<10.11.7

[
  {
    "vendor": "jellyfin",
    "product": "jellyfin",
    "versions": [
      {
        "version": "< 10.11.7",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/jellyfin/jellyfin/security/advisories/GHSA-jh22-fw8w-2v9x
github	www.github.com/jellyfin/jellyfin/releases/tag/v10.11.7

Parameter	Position	Path	Description	CWE
StreamOptions	query param	/Videos/{itemId}/stream	Unauthenticated arbitrary file read via ffmpeg argument injection through the StreamOptions query parameter in Jellyfin's /Videos/{itemId}/stream endpoint.	CWE-862, CWE-88

24 Jul 2026 21:10Current

6Medium risk

Vulners AI Score6

CVSS 3.19.1

CVSS 49.3

EPSS0.00522

SSVC