Jellyfin EUVD-2026-39030

Exploitation requires (1) the attacker to place a file with a crafted name containing a double-quote character into a directory indexed by a Jellyfin media library - typically via a shared NAS export, a writable Samba/NFS share, or an enabled guest/anonymous upload path; (2) the server running on Linux, whose filesystem permits double-quote characters in filenames (this is the limiting platform condition - Windows naming rules block the technique); and (3) network reachability to the SubtitleController.GetSubtitle endpoint, which requires no Jellyfin authentication because it lacks an [Authorize] attribute. The principal limiting factor is the file-write prerequisite: deployments where no untrusted party can introduce files into library directories are not exploitable, even though the HTTP trigger itself is unauthenticated.

Signals are largely consistent toward elevated but conditional risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 8.8) reflects a network-reachable, high-impact issue. However, there is a notable nuance: the description states the endpoint is reachable WITHOUT authentication (no [Authorize] attribute), which would normally argue PR:N, yet the real gating precondition is the attacker's ability to write a crafted-name file into a media library directory - a filesystem-level capability rather than a Jellyfin login. The PR:L in the published vector is best read as capturing that file-placement requirement; defenders should not treat this as trivially remote-unauthenticated against a hardened deployment. No EPSS score was provided in the input, and the CVE is not in CISA KEV; no POC was supplied, so this is not confirmed as actively exploited. The combination of an unauthenticated HTTP trigger plus a common deployment pattern (shared media directories) makes this a real patch priority for internet- or LAN-exposed instances, while pure single-user installations with no external file-write path face lower practical risk. EPSS data is missing - verify before final prioritization.

An attacker with write access to a media folder Jellyfin scans - for example through a guest-writable Samba share or a NAS export - drops a subtitle or media file whose name contains a double-quote followed by injected FFmpeg arguments. They then request that item's subtitle via the unauthenticated SubtitleController.GetSubtitle endpoint over the network (AV:N/AC:L), causing Jellyfin to invoke FFmpeg with the attacker-controlled flags and write or exfiltrate files on the server. No public exploit is identified at time of analysis.