CVE-2024-43801

CVE-2024-43801 affects Jellyfin (self-hosted media server). The vulnerability arises from accepting SVG uploads for user profiles, enabling a stored XSS that could let an admin load a crafted SVG outside Jellyfin’s Web UI, interact with the browser LocalStorage, and exfiltrate an AccessToken to e...