What’s Vulnerable › Vulnerabilities
CVE-2026-49247: Jellyfin: Potential Authenticated path traversal in /ClientLog/Document
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-24 · updated 2026-06-26
- Weakness: CWE-22
Description
Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog/Document endpoint accepts the Authorization header's Client and Version fields and uses them unsanitized as components of the on-disk filename when persisting client-uploaded log documents. As a result, any authenticated non-admin user can include ../ sequences in the Client field to cause Jellyfin to write attacker-controlled content to arbitrary paths reachable by the Jellyfin service user, with a forced .log suffix. This vulnerability is fixed in 10.11.10.
Affected products
- jellyfin: from 10.9.0, < 10.11.10
References
Get alerted when CVE-2026-49247 or the next vulnerability affects your stack