Which versions of Jellyfin are affected by CVE-2026-35033?

Jellyfin media server versions before 10.11.7 contain a critical arbitrary file read vulnerability that allows unauthenticated attackers to exfiltrate sensitive files such as /etc/shadow through…. A patch is available.

How to fix or mitigate CVE-2026-35033?

Within 24 hours: Identify all Jellyfin deployments and document current versions. Within 7 days: Upgrade all Jellyfin instances to version 10.11.7 or later; if immediate upgrade is not feasible, implement network-level access controls restricting Jellyfin to trusted networks only. Within 30 days: Conduct security audit of affected systems, rotate any credentials that may have been exposed, and review access logs for suspicious StreamOptions query parameters.

Jellyfin CVE-2026-35033

Q: What is the CVSS score of CVE-2026-35033?

CVE-2026-35033 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-22768 CRITICAL

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-04-14 GitHub_M

Authentication Bypass Jellyfin

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 23, 2026 - 14:02 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:44 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.11.7

Analysis Generated

Apr 15, 2026 - 01:09 vuln.today

CVSS changed

Apr 14, 2026 - 23:22 NVD

9.3 (CRITICAL)

EUVD ID Assigned

Apr 14, 2026 - 22:46 euvd

EUVD-2026-22768

Analysis Generated

Apr 14, 2026 - 22:46 vuln.today

CVE Published

Apr 14, 2026 - 22:28 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any lowercase query parameter to a dictionary without validation, bypassing the RegularExpression attribute on the level controller parameter, and the unsanitized value is concatenated directly into the ffmpeg command line. By injecting a drawtext filter with a textfile argument, an attacker can read arbitrary server files such as /etc/shadow and exfiltrate their contents as text rendered in the video stream response. The vulnerable /Videos/{itemId}/stream endpoint has no Authorize attribute, making this exploitable without authentication, though item GUIDs are pseudorandom and require an authenticated user to obtain. This issue has been fixed in version 10.11.7.

AnalysisAI

Arbitrary file read via ffmpeg argument injection in Jellyfin media server versions before 10.11.7 allows unauthenticated remote attackers to exfiltrate sensitive server files (including /etc/shadow) through malicious StreamOptions query parameters. The vulnerability bypasses input validation by exploiting the ParseStreamOptions method, which concatenates unsanitized lowercase query parameters directly into ffmpeg command lines, enabling drawtext filter injection to render file contents in video streams. CVSS 9.3 (Critical) with network attack vector and no authentication required. No public exploit identified at time of analysis, though the technical details in the advisory provide a clear exploitation path.

Technical ContextAI

This vulnerability stems from improper neutralization of special elements used in a command (CWE-88), specifically command injection into ffmpeg. Jellyfin's StreamingHelpers.cs ParseStreamOptions method processes URL query parameters and adds any lowercase parameter to a dictionary without validation, despite RegularExpression attributes intended to sanitize the StreamOptions controller parameter. These unsanitized values are then concatenated directly into ffmpeg command line arguments. FFmpeg's extensive filter capabilities include the drawtext filter, which accepts a textfile parameter to render file contents as overlaid text. By crafting a malicious query with injected filter syntax like drawtext=textfile=/etc/shadow, attackers exploit ffmpeg's trusted position to read arbitrary files accessible to the Jellyfin process. The affected product is Jellyfin media server (CPE: cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*), a self-hosted alternative to proprietary streaming platforms. The /Videos/{itemId}/stream endpoint lacks authorization controls, though exploitation requires knowledge of valid item GUIDs which are pseudorandom.

RemediationAI

Vendor-released patch: version 10.11.7 released on the official GitHub repository at https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 fully addresses this vulnerability by implementing proper input validation and sanitization in the StreamOptions parsing mechanism. Administrators should immediately upgrade all Jellyfin instances to version 10.11.7 or later through their standard update procedures. For containerized deployments, pull the jellyfin/jellyfin:10.11.7 or jellyfin/jellyfin:latest image and restart containers. As a temporary mitigation for environments where immediate patching is not feasible, restrict network access to the Jellyfin server using firewall rules to allow only trusted IP ranges, implement reverse proxy authentication requiring credentials before reaching the Jellyfin endpoint, or disable the streaming endpoint entirely if not required. Monitor access logs for suspicious query parameters containing ffmpeg filter syntax (drawtext, textfile, lavfi) as indicators of exploitation attempts. No workaround provides complete protection; upgrading remains the only definitive remediation.