Jellyfin CVE-2026-49246

The MKV file must be present in a Jellyfin media library and must be played back by a Jellyfin client. Subtitle burn-in must be active during playback - this is enabled by default for clients that support it, meaning no special client configuration change is required by the victim. The attacker must control or be able to influence the content of files in the Jellyfin media library (e.g., via a shared network path, a writable NAS mount, or a social-engineering vector such as convincing a user to add an external file). Exploitation is limited by the OS-level write permissions of the Jellyfin server process: on systems where Jellyfin runs as a low-privilege service account, writable paths are restricted to media directories and application data folders. Administrative or root-level Jellyfin deployments face broader exposure. No authentication on the Jellyfin server is required from the attacker's perspective, but delivering the file to the library is the primary prerequisite.

The vendor-assigned CVSS 4.0 score of 1.7 (vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U) reflects the constrained real-world impact: only low integrity is affected (file write to arbitrary path), no confidentiality or availability is impacted, and exploitation status is Unreported. High attack complexity (AC:H) accounts for the requirement to craft a precisely forged MKV and ensure the file reaches a target's library. The impact ceiling is bounded by the OS permissions of the Jellyfin process - on hardened deployments running Jellyfin as a restricted service account, arbitrary file writes may be further constrained. No EPSS data was provided in the input; given the self-hosted niche footprint and low CVSS score, broad automated exploitation is not anticipated. There is no CISA KEV listing and no public proof-of-concept identified. One tension worth noting: the CVSS 4.0 vector assigns UI:N, yet the description requires a user to play back the malicious file - this may understate user-interaction dependency. Defenders should treat this as a meaningful write-primitive risk in the context of Jellyfin's process account privileges, not a critical systemic threat.

An attacker crafts an MKV video file embedding an attachment whose filename tag is set to an absolute or path-traversal path such as '/etc/cron.d/backdoor'. The file is placed into a Jellyfin media library - either through a shared network folder, a compromised upload mechanism, or social engineering. When any Jellyfin client plays the video and the default subtitle burn-in is triggered, the server extracts the attachment to the attacker-controlled path, potentially writing arbitrary content to sensitive filesystem locations within the reach of Jellyfin's process account. No public proof-of-concept has been identified at time of analysis.