CVE Explorer

CVE-2026-49246

Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exploit missing path sanitization during playback. Jellyfin treats the MKV file name tag on MKV attachments as trusted and passes it unsanitized into Path.Combine(attachmentFolder, fileName) inside PathManager.GetAttachmentPath. Because .NET's Path.Combine neither normalises .. nor rejects a rooted second argument, a crafted MKV can redirect

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:89fd9be95e1849722023d48885499a9fa2f52b28197edcd22bd76c1f8243b1ee

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"jellyfin","vendor":"jellyfin","versions":[{"status":"affected","version":"< 10.11.10"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:504100a6b3f23d8c5f2a4fe05535467697f9c0e5ca90b1963d4ba330568ff91a · sha256:b2bfb5f73aa11699… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":1.7,"baseSeverity":"LOW","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:504100a6b3f23d8c5f2a4fe05535467697f9c0e5ca90b1963d4ba330568ff91a · sha256:b2bfb5f73aa11699… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:504100a6b3f23d8c5f2a4fe05535467697f9c0e5ca90b1963d4ba330568ff91a · sha256:b2bfb5f73aa11699… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/jellyfin/jellyfin/security/advisories/GHSA-f47c-m7gr-q92j","tags":["x_refsource_CONFIRM"],"url":"https://github.com/jellyfin/jellyfin/security/advisories/GHSA-f47c-m7gr-q92j"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:504100a6b3f23d8c5f2a4fe05535467697f9c0e5ca90b1963d4ba330568ff91a · sha256:b2bfb5f73aa11699… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer