What is the CVSS score of CVE-2026-49247?

CVE-2026-49247 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Jellyfin are affected by CVE-2026-49247?

Jellyfin media server deployments running versions 10.9.0 through 10.11.9 are vulnerable to compromise by any user with standard credentials, potentially allowing unauthorized actors to gain complete…. A patch is available.

How to fix or mitigate CVE-2026-49247?

Within 24 hours: identify all Jellyfin installations in the environment and document current versions. Within 7 days: complete upgrade of all affected instances to Jellyfin 10.11.10 or later. Within 30 days: verify successful deployment across all instances and audit server logs for unauthorized access attempts targeting the /ClientLog/Document endpoint.

Jellyfin CVE-2026-49247

EUVD-2026-39028 HIGH

Path Traversal (CWE-22)

2026-06-24 GitHub_M

Path Traversal Jellyfin

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Network, low-complexity, authenticated non-admin (PR:L), no UI; the primitive is an arbitrary .log write giving high integrity impact, no inherent read so C:N, and limited availability (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 24, 2026 - 20:03 EUVD

Analysis Generated

Jun 24, 2026 - 19:19 vuln.today

DescriptionCVE.org

Jellyfin is an open source self hosted media server. From 10.9.0 until 10.11.10, the POST /ClientLog/Document endpoint accepts the Authorization header's Client and Version fields and uses them unsanitized as components of the on-disk filename when persisting client-uploaded log documents. As a result, any authenticated non-admin user can include ../ sequences in the Client field to cause Jellyfin to write attacker-controlled content to arbitrary paths reachable by the Jellyfin service user, with a forced .log suffix. This vulnerability is fixed in 10.11.10.

AnalysisAI

Arbitrary file write in Jellyfin media server (10.9.0 through 10.11.9) lets any authenticated non-admin user abuse the POST /ClientLog/Document endpoint to plant attacker-controlled content outside the intended log directory. The endpoint trusts the Client and Version fields of the Authorization header and uses them unsanitized to build the on-disk filename, so embedding ../ sequences in the Client field redirects writes to any path reachable by the Jellyfin service account, with a forced .log extension. No public exploit has been identified at time of analysis, and the issue is fixed in 10.11.10.

Technical ContextAI

Jellyfin is a widely used open-source, self-hosted media server (the cpe:2.3:a:jellyfin:jellyfin product) written in .NET, exposing an HTTP API to authenticated clients. The diagnostic endpoint POST /ClientLog/Document persists client-uploaded log documents to disk and derives the target filename from the Client and Version values supplied in the Authorization header. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): user-controlled header components are concatenated into a filesystem path without canonicalization or directory containment, so relative traversal tokens (../) escape the intended log folder. The server appends a fixed .log suffix, constraining the resulting filename extension but not the directory the file lands in.

RemediationAI

Upgrade to Jellyfin 10.11.10, which sanitizes the Client/Version header components before using them in log filenames (Vendor-released patch: 10.11.10); see https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jg92-mrxq-vv75. Until you can patch, reduce exposure by disabling open/public user self-registration and tightly controlling who holds accounts, since the attacker needs an authenticated non-admin login, and by restricting network reachability of the Jellyfin API to trusted clients via firewall or reverse-proxy access controls - note this does not stop already-trusted internal users. As defense-in-depth, run the Jellyfin service under a least-privileged OS account so the writable-path blast radius is minimized; blocking or filtering the /ClientLog/Document endpoint at a reverse proxy stops the attack but also disables legitimate client log uploads.