Server-Side Request Forgery Vulnerability in Jellyfin by Jellyfin
CVE-2026-119549

7.1HIGH

Key Information:

Vendor

Jellyfin

Status
Jellyfin
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119549?

Jellyfin versions up to 12.4 are affected by a server-side request forgery (SSRF) vulnerability that allows authenticated users to bypass the SvgSecurityValidator. This exploitation is accomplished by embedding gzip-compressed SVG content within non-SVG image data URIs. Attackers can upload manipulated profile images via a specific endpoint and later trigger unauthenticated rendering, enabling them to access internal URLs, read local image files, or deplete system memory resources.

Affected Version(s)

jellyfin 0 <= 12.4

References

https://github.com/jellyfin/jellyfin/blob/v12.4/src/Jelly...
technical-description
https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin....
technical-description
https://github.com/jellyfin/jellyfin/security/advisories/...
relatedvendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.