Jellyfin EUVD-2026-113814

Requires an authenticated low-privilege account on the Jellyfin server; the attacker sets a profile image via POST /UserImage, which accepts SVG as an image type. The specific trigger is embedding gzip-compressed SVG inside a non-SVG image data URI, which bypasses the SvgSecurityValidator allow-check; the server then rasterizes the SVG through Svg.Skia with library defaults that resolve external <image xlink:href> references (http://, https://, file://). Rendering is reachable via an unauthenticated GET /UserImage, and the stored SVG is re-rasterized on every subsequent request, giving a repeatable DoS trigger from one upload. Only responses/files that decode as an image can be exfiltrated. An alternate path requires an administrator to be induced to import media accompanied by a crafted poster.svg artwork file (the admin need not author the file). Limiting factors: upload requires authentication (PR:L), SSRF exfiltration is constrained to image-decodable content, and the admin-import variant depends on administrator action.

CVSS 4.0 rates this 7.1 (High), driven by VA:H (availability via memory exhaustion) with VC:L (limited confidentiality from image-decodable file/URL disclosure) and no integrity impact. The vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-reachable, low-complexity exploitation requiring only low-privilege authentication and no user interaction. CWE-918 (SSRF) is confirmed by NVD and the vendor GHSA advisory. No EPSS score and no KEV status were provided in the input, so exploitation probability and active-exploitation signals cannot be quantified; absence of KEV means there is no confirmation of in-the-wild use. A public PoC reference exists (abraxaslabs research write-up and VulnCheck advisory); it is not verified as working exploit code in the supplied data. The vuln.today decision label is this_week, so this should be prioritized within the week rather than treated as an emergency, consistent with the lack of KEV. Signals are broadly consistent: the main gating factor is the PR:L authentication requirement, which limits the SSRF/file-read path to registered users, while the re-rasterization DoS is repeatable from a single upload. One caveat: the vendor GHSA patch and workaround sections are empty templates and the input does not confirm a fixed version, so remediation guidance should be verified with the vendor.

A low-privilege authenticated Jellyfin user uploads a crafted profile image via POST /UserImage containing gzip-compressed SVG hidden in a non-SVG image data URI, bypassing SvgSecurityValidator. When the image is rendered server-side (reachable via an unauthenticated GET /UserImage), the SVG parser resolves external references, letting the attacker fetch internal http(s):// URLs or read local file:// paths that decode as images and are returned to the requester, or reference an endless file like /dev/urandom to exhaust server memory. A public PoC reference exists but is not verified as working exploit code.