Path Traversal Vulnerability in Jellystat Statistics App for Jellyfin

CVE-2025-24960

What is CVE-2025-24960?

The Jellystat Statistics App for Jellyfin has a path traversal vulnerability that allows unauthorized access to system files through user input in administrative routes. Specifically, the affected versions enable the use of the DELETE command on any specified file, posing a significant risk to system integrity. This issue is primarily restricted to administrative functions, yet it still warrants immediate attention. Users should upgrade to version 1.1.3 to mitigate this vulnerability, as there are no known workarounds available.

References