Path Traversal Vulnerability in Jellyfin Media Server

CVE-2026-35031

What is CVE-2026-35031?

Jellyfin, an open-source media server, has a vulnerability in the subtitle upload functionality that allows for path traversal through an unvalidated Format field. This flaw enables malicious actors to exploit arbitrary file writes, leading potentially to unauthorized access to system files, database information, and escalation of privileges. Exploitation requires an administrator account or a user with specific permissions. It is crucial for users to update to version 10.11.7, which addresses this vulnerability, or to limit subtitle upload permissions to mitigate risks.

References