CVE-2023-48702

Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the "/System/MediaEncoder/Path" endpoint executes an arbitrary file using "ProcessStartInfo" via the "ValidateVersion" function. A malicious administrator can setup a network share and supply a UNC path to...

CVE-2023-48702: Improper Neutralization of Special Elements used in a Command

Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the /System/MediaEncoder/Path endpoint executes an arbitrary file using ProcessStartInfo via the ValidateVersion function. A malicious administrator can setup a network share and supply a UNC path to...