CVE-2026-35033
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Jellyfin prior to version 10.11.7 has an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions parameter. An attacker can read server files such as /etc/shadow and exfiltrate their contents as text in the video stream response.
Risk Assessment
An attacker can read sensitive system files, potentially leading to disclosure of passwords and other confidential information.
Recommendation
Update Jellyfin to version 10.11.7 or later, which includes a fix for the ffmpeg argument injection vulnerability.
Original NVD description (English source)
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any lowercase query parameter to a dictionary without validation, bypassing the RegularExpression attribute on the level controller parameter, and the unsanitized value is concatenated directly into the ffmpeg command line. By injecting a drawtext filter with a textfile argument, an attacker can read arbitrary server files such as /etc/shadow and exfiltrate their contents as text rendered in the video stream response. The vulnerable /Videos/{itemId}/stream endpoint has no Authorize attribute, making this exploitable without authentication, though item GUIDs are pseudorandom and require an authenticated user to obtain. This issue has been fixed in version 10.11.7.