FFmpeg Command Injection Vulnerability in Jellyfin Media Server

CVE-2026-48793

What is CVE-2026-48793?

A command injection vulnerability exists in the Jellyfin Media Server prior to version 10.11.10. The issue stems from the subtitle conversion code path, specifically in the SubtitleEncoder.ConvertTextSubtitleToSrtInternal method. Here, user-controlled input, such as subtitle file paths, is incorporated into command-line arguments for FFmpeg without proper sanitization, exposing the system to potential argument injection. This vulnerability can be exploited by an unauthenticated attacker who can upload a malicious file into a Jellyfin media library directory, enabling arbitrary command execution and potential information disclosure on Linux systems.

References