CVE-2021-21402-Jellyfin

CVE-2021-21402-Jellyfin Arbitrary File Read This POC is for learning and communication only. I am not responsible for any consequences arising from its use. python POC.py targets.txt...

jellyfin-suggestions-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · jellyfin-suggestions-idor jellyfin-suggestions-idor Jellyfin Server 12.2 - Jellyfin Class: IDOR. Reach: Remote any authenticated non-admin. GET /Items/Suggestions is Authorize only. When userId is omitted,...

Jellyfin 10.7.2 - Server Side Request Forgery

Jellyfin is a free software media system. Versions 10.7.2 and below are vulnerable to unauthenticated Server-Side Request Forgery SSRF attacks via the imageUrl parameter. id: CVE-2021-29490 info: name: Jellyfin 10.7.2 - Server Side Request Forgery author: alph4byt3 severity: medium description: |...

CVE-2021-21402

CVE-2021-21402 CVE-2021-21402 Jellyfin arbitrary file read Wker script, batchable. The logic is very simple, it checks for the existence of win.ini via GET: define payload = /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/ define info = CVE-2021-21402 Jellyfin任意文件读取 functi...

gha-lab-3f1ff30e9c

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of jellyfin/jellyfin-ios at commit...

CVE-2021-21402

CVE-2021-21402 Jellyfin Arbitrary File Read Vulnerability Overview Jellyfin is a free software media system that controls and manages media and streaming. It is an alternative to Emby and Plex, delivering media from a dedicated server to end-user devices through multiple applications. Jellyfin...

CVE-2026-119551

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without...

CVE-2026-119549

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering vi...

CVE-2026-119550

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from...

CVE-2026-119551 Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without...

CVE-2026-119550 Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from...

EUVD-2026-113816

Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. Attackers can repeatedly call GET /Items/Suggestions without...

CVE-2026-119551

Jellyfin versions through 12.4 are affected by an authorization bypass vulnerability in the SuggestionsController.GetSuggestions function. This flaw occurs because the application fails to properly validate the userId parameter, allowing authenticated non-administrator users to bypass library and...

EUVD-2026-113815

Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled users can obtain GUIDs of inaccessible library items from...

CVE-2026-119550

Jellyfin versions through 12.4 are affected by an information disclosure vulnerability in PlaylistsController.GetPlaylist . Authenticated users can request public or shared playlists to read hidden item IDs . Specifically, restricted or parental-controlled users can extract GUIDs of inaccessible ...

CVE-2026-119549 Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering vi...

CVE-2026-119549

Jellyfin versions up to and including 12.4 are vulnerable to a Server-Side Request Forgery (SSRF) . The root cause is a bypass of the SvgSecurityValidator when users embed gzip-compressed SVG data within non-SVG image data URIs. An authenticated user can upload a malicious profile image via POST ...

CVE-2026-119549 Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering vi...

EUVD-2026-113814

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering vi...

Jellyfin <10.7.0 - Local File Inclusion

Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk. id: CVE-2021-21402 info: name: Jellyfin 10.7.0 - Local File Inclusion author: dwisiswant0 severity: medium...