Jellyfin CVE-2026-35031

Requires authenticated access as Jellyfin administrator or user explicitly granted subtitle upload permission. Attacker exploits unvalidated Format field in POST /Videos/{itemId}/Subtitles endpoint to write arbitrary files via path traversal, then chains to RCE via ld.so.preload. Affects Jellyfin versions prior to 10.11.7.

This vulnerability presents critical real-world risk despite requiring authenticated access. The CVSS 9.9 score accurately reflects severity: network-accessible (AV:N), low complexity (AC:L), requires only low privileges (PR:L), no user interaction (UI:N), scope change (S:C indicating container/system boundary escape), and complete confidentiality, integrity, and availability impact (C:H/I:H/A:H). The attack chain from authenticated file upload to root RCE is technically sophisticated but fully documented in the vendor advisory with clear exploitation steps. The PR:L requirement is mitigated by Jellyfin's permission model where administrators may grant 'Upload Subtitles' to regular users for legitimate functionality. No public exploit code identified at time of analysis, and no CISA KEV listing indicates this is not confirmed actively exploited. However, the detailed public disclosure in GitHub Security Advisory GHSA-j2hf-x4q5-47j3 provides a complete exploitation roadmap. SSVC assessment: exploitation status is publicly available (PoC steps disclosed), attack is automatable once credentials obtained, technical impact is total system compromise. This warrants immediate patching priority for internet-facing Jellyfin instances, especially those with multiple user accounts or relaxed permission models.

An attacker with a regular Jellyfin user account granted 'Upload Subtitles' permission crafts a malicious subtitle upload request with a path traversal payload in the Format field (e.g., '../../../../tmp/malicious.strm'). This writes a .strm playlist file containing a path to the Jellyfin SQLite database. The attacker triggers playback of this .strm file through the media library, causing Jellyfin to read and expose database contents including admin password hashes. Using cracked or plaintext admin credentials, the attacker authenticates as administrator, uploads another malicious file to /etc/ld.so.preload pointing to an attacker-controlled shared library, and triggers any system process execution to load the malicious library, achieving arbitrary code execution as root with complete server compromise.