Jellyfin EUVD-2026-39028

Exploitation requires a valid authenticated non-admin Jellyfin account (CVSS PR:L) and the ability to send a POST request to the /ClientLog/Document endpoint over the network; the attacker supplies ../ traversal sequences in the Authorization header's Client field. Affected versions are 10.9.0 through 10.11.9. Limiting factors: an account is mandatory (no unauthenticated path), so instances without untrusted or self-registered users are far lower risk; the written file is forced to end in .log, which constrains which targets are useful and largely blocks straightforward source-file or RCE overwrites; and writes are bounded to paths the Jellyfin service user can reach, so least-privilege deployment shrinks the impact.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects a network-reachable, low-complexity attack needing only a valid low-privilege account and no user interaction - realistic for any Jellyfin instance with self-registration or shared/family accounts. EPSS, KEV, and SSVC data were not provided in the input; there is no CISA KEV listing and no public exploit identified, so this is not confirmed active exploitation. The headline 8.8 likely overstates real impact: the forced .log suffix means the primitive is an arbitrary-location write of .log files, which strongly constrains direct code execution and gives no inherent read/confidentiality capability, so the C:H rating is questionable and the practical worst case is integrity/availability damage (corrupting or filling writable paths owned by the service user). Net: a genuine privilege-relevant flaw worth prompt patching where untrusted users hold accounts, but absent KEV/POC/EPSS signals it is a patch-soon rather than emergency item; verify the confidentiality impact against the vendor advisory.

A user with an ordinary non-admin Jellyfin account authenticates and sends a POST /ClientLog/Document request whose Authorization header Client field contains ../ traversal sequences, causing Jellyfin to write the request body to a chosen path reachable by the service user, ending in .log. By overwriting or planting files the service can later read or act on in its context, the attacker corrupts data or stages further compromise. No public exploit has been identified at time of analysis, and the network/low-complexity vector makes scripting trivial for anyone holding credentials.