What is the CVSS score of CVE-2026-49247?

CVE-2026-49247 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Jellyfin are affected by CVE-2026-49247?

Jellyfin media server deployments running versions 10.9.0 through 10.11.9 are vulnerable to compromise by any user with standard credentials, potentially allowing unauthorized actors to gain complete…. A patch is available.

How to fix or mitigate CVE-2026-49247?

Within 24 hours: identify all Jellyfin installations in the environment and document current versions. Within 7 days: complete upgrade of all affected instances to Jellyfin 10.11.10 or later. Within 30 days: verify successful deployment across all instances and audit server logs for unauthorized access attempts targeting the /ClientLog/Document endpoint.

Jellyfin CVE-2026-49247

EUVD-2026-39028 HIGH

Path Traversal (CWE-22)

2026-06-24 GitHub_M

Path Traversal Jellyfin

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Network, low-complexity, authenticated non-admin (PR:L), no UI; the primitive is an arbitrary .log write giving high integrity impact, no inherent read so C:N, and limited availability (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 20:03 EUVD

Analysis Generated

Jun 24, 2026 - 19:19 vuln.today

DescriptionCVE.org

Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog/Document endpoint accepts the Authorization header's Client and Version fields and uses them unsanitized as components of the on-disk filename when persisting client-uploaded log documents. As a result, any authenticated non-admin user can include ../ sequences in the Client field to cause Jellyfin to write attacker-controlled content to arbitrary paths reachable by the Jellyfin service user, with a forced .log suffix. This vulnerability is fixed in 10.11.10.

AnalysisAI

Arbitrary file write in Jellyfin media server (10.9.0 through 10.11.9) lets any authenticated non-admin user abuse the POST /ClientLog/Document endpoint to plant attacker-controlled content outside the intended log directory. The endpoint trusts the Client and Version fields of the Authorization header and uses them unsanitized to build the on-disk filename, so embedding ../ sequences in the Client field redirects writes to any path reachable by the Jellyfin service account, with a forced .log extension. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate with low-privilege account

Delivery

Craft Authorization header with ../ in Client field

Exploit

POST body to /ClientLog/Document

Execution

Server writes content to traversed path (.log)

Impact

Corrupt or stage files in service-user paths

Access

Authenticate with low-privilege account

Delivery

Craft Authorization header with ../ in Client field

Exploit

POST body to /ClientLog/Document

Execution

Server writes content to traversed path (.log)

Impact

Corrupt or stage files in service-user paths

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated non-admin Jellyfin account (CVSS PR:L) and the ability to send a POST request to the /ClientLog/Document endpoint over the network; the attacker supplies ../ traversal sequences in the Authorization header's Client field. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity attack needing only a valid low-privilege account and no user interaction - realistic for any Jellyfin instance with self-registration or shared/family accounts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A user with an ordinary non-admin Jellyfin account authenticates and sends a POST /ClientLog/Document request whose Authorization header Client field contains ../ traversal sequences, causing Jellyfin to write the request body to a chosen path reachable by the service user, ending in .log. By overwriting or planting files the service can later read or act on in its context, the attacker corrupts data or stages further compromise. …
Remediation	Upgrade to Jellyfin 10.11.10, which sanitizes the Client/Version header components before using them in log filenames (Vendor-released patch: 10.11.10); see https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jg92-mrxq-vv75. … Detailed patch versions, workarounds, and compensating controls in full report.