Path Traversal Vulnerability in Jellyfin by Jellyfin
CVE-2026-126499

8.3HIGH

Key Information:

Vendor

Jellyfin

Status
Jellyfin
Vendor
CVE Published:
11 November 2026

What is CVE-2026-126499?

Jellyfin versions prior to 12.0 have a significant path traversal issue that affects the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. This vulnerability allows unauthenticated attackers to manipulate directory names using special characters such as '..' or by providing absolute paths. By exploiting this flaw, attackers can recursively delete the data directory and the critical jellyfin.db file, leading to potential data loss and service disruption.

Affected Version(s)

jellyfin 0 < 12.0

References

https://github.com/jellyfin/jellyfin/security/advisories/...
vendor-advisory
https://github.com/jellyfin/jellyfin/commit/0c560b22ce733...
patch
https://github.com/jellyfin/jellyfin/releases/tag/v12.0
release-notes

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.