CVE-2026-35031

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35031", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-31T21:06:06.427Z", "datePublished": "2026-04-14T22:18:30.565Z", "dateUpdated": "2026-04-16T13:56:06.801Z"}, "containers": {"cna": {"title": "Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-187", "lang": "en", "description": "CWE-187: Partial String Comparison", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3"}, {"name": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7"}], "affected": [{"vendor": "jellyfin", "product": "jellyfin", "versions": [{"version": "< 10.11.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T22:18:30.565Z"}, "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the \"Upload Subtitles\" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface."}], "source": {"advisory": "GHSA-j2hf-x4q5-47j3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T13:55:27.873525Z", "id": "CVE-2026-35031", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:56:06.801Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35031", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T13:55:27.873525Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:55:58.246Z"}}], "cna": {"title": "Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain", "source": {"advisory": "GHSA-j2hf-x4q5-47j3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jellyfin", "product": "jellyfin", "versions": [{"status": "affected", "version": "< 10.11.7"}]}], "references": [{"url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3", "name": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "name": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the \"Upload Subtitles\" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-187", "description": "CWE-187: Partial String Comparison"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T22:18:30.565Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35031", "state": "PUBLISHED", "dateUpdated": "2026-04-16T13:56:06.801Z", "dateReserved": "2026-03-31T21:06:06.427Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T22:18:30.565Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jellyfin", "vendor": "jellyfin", "versions": [{"status": "affected", "version": "< 10.11.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*", "matchCriteriaId": "16256CB1-CEA1-4216-B492-D9016420F60D", "versionEndExcluding": "10.11.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the \"Upload Subtitles\" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface."}, {"lang": "es", "value": "Jellyfin es un servidor multimedia autoalojado de c\u00f3digo abierto. Las versiones anteriores a la 10.11.7 contienen una cadena de vulnerabilidades en el punto final de carga de subt\u00edtulos (POST /Videos/{itemId}/Subtitles), donde el campo Format no se valida, lo que permite el salto de ruta a trav\u00e9s de la extensi\u00f3n de archivo y habilita la escritura arbitraria de archivos. Esta escritura arbitraria de archivos se puede encadenar con la lectura arbitraria de archivos a trav\u00e9s de archivos .strm, la extracci\u00f3n de la base de datos, la escalada de privilegios de administrador y, en \u00faltima instancia, la ejecuci\u00f3n remota de c\u00f3digo como root a trav\u00e9s de ld.so.preload. La explotaci\u00f3n requiere una cuenta de administrador o un usuario al que se le haya concedido expl\u00edcitamente el permiso 'Cargar subt\u00edtulos'. Este problema se ha solucionado en la versi\u00f3n 10.11.7. Si los usuarios no pueden actualizar de inmediato, pueden conceder permisos de carga de subt\u00edtulos a usuarios no administradores para reducir la superficie de ataque."}], "id": "CVE-2026-35031", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35031", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T13:55:27.873525Z", "version": "2.0.3"}}]}, "published": "2026-04-14T23:16:28.490", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-187"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.11.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jellyfin", "source": "cna", "vendor": "jellyfin"}, "product": "jellyfin", "vendor": "jellyfin"}], "analysis": {"en": {"generated_at": "2026-04-14T23:21:18.364830+00:00", "value": {"mitigation_remediation": ["Upgrade Jellyfin to version 10.11.7 or later, which removes the path traversal and subtitle upload flaw.", "If upgrading is not immediately feasible, limit the \"Upload Subtitles\" permission to administrators only, removing or reducing it for all other users to minimize the risk of an attacker using this capability.", "Monitor for anomalous POST requests to the subtitle upload endpoint and for suspicious file write activity, and isolate or block the server from the network if unauthorized activity is detected."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Jellyfin media server produced by the jellyfin: jellyfin vendor. Only releases earlier than 10.11.7 are impacted; version 10.11.7 and later contain the fix. The vulnerability is activated when an authenticated user possessing the \"Upload Subtitles\" permission accesses the POST /Videos/{itemId}/Subtitles endpoint.", "description_and_impact": "Jellyfin versions prior to 10.11.7 contain a flaw in the subtitle upload endpoint where the Format field is not validated, permitting path traversal through crafted file extensions. This flaw allows an attacker to write arbitrary files on the server, which can then be leveraged to read arbitrary files via .strm chaining, extract database credentials, elevate privileges to an administrator level, and ultimately execute code as the root user through the ld.so.preload mechanism. The compromise results in full compromise of confidentiality, integrity, and availability of the affected system.", "risk_and_exploitability": "The CVSS score of 10 indicates a critical severity. Exploitation requires authenticated access and either an administrator account or a user explicitly given the Upload Subtitles privilege. Public exposure is possible only if such a user account exists, though administrators may log in via the web interface from anywhere. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, but the absence of mitigation does not reduce the inherent risk provided the vulnerable server is accessible."}}}}, "created": "2026-04-15T13:48:23.616261+00:00", "updated": "2026-04-15T14:31:57.024465+00:00", "vendors": ["jellyfin", "jellyfin$PRODUCT$jellyfin"]}