Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution

CVE-2023-30626

What is CVE-2023-30626?

The Jellyfin media system is impacted by a directory traversal vulnerability in the ClientLogController, specifically targeting the /ClientLog/Document endpoint. This flaw allows an attacker to potentially exploit the system, particularly when combined with a cross-site scripting vulnerability, leading to unauthorized file writes and the execution of arbitrary code. To mitigate this issue, users are advised to upgrade to version 10.8.10, which contains the necessary patches. Currently, no workarounds are available to address this security concern.

References