CVE-2026-35032

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35032", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-31T21:06:06.427Z", "datePublished": "2026-04-14T22:25:35.729Z", "dateUpdated": "2026-04-15T20:02:29.887Z"}, "containers": {"cna": {"title": "Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8"}, {"name": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7"}], "affected": [{"vendor": "jellyfin", "product": "jellyfin", "versions": [{"version": "< 10.11.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T22:25:35.729Z"}, "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. This is exploitable by any authenticated user because the EnableLiveTvManagement permission defaults to true for all new users. An attacker can chain these vulnerabilities by adding an M3U tuner pointing to an attacker-controlled server, serving a crafted M3U with a channel pointing to the Jellyfin database, exfiltrating the database to extract admin session tokens, and escalating to admin privileges. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can disable Live TV Management privileges for all users."}], "source": {"advisory": "GHSA-8fw7-f233-ffr8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T18:45:46.875262Z", "id": "CVE-2026-35032", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T20:02:29.887Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35032", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T18:45:46.875262Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T18:47:25.308Z"}}], "cna": {"title": "Jellyfin: Potential SSRF + Arbitrary file read via LiveTV M3U tuner", "source": {"advisory": "GHSA-8fw7-f233-ffr8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jellyfin", "product": "jellyfin", "versions": [{"status": "affected", "version": "< 10.11.7"}]}], "references": [{"url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8", "name": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "name": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. This is exploitable by any authenticated user because the EnableLiveTvManagement permission defaults to true for all new users. An attacker can chain these vulnerabilities by adding an M3U tuner pointing to an attacker-controlled server, serving a crafted M3U with a channel pointing to the Jellyfin database, exfiltrating the database to extract admin session tokens, and escalating to admin privileges. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can disable Live TV Management privileges for all users."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T22:25:35.729Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35032", "state": "PUBLISHED", "dateUpdated": "2026-04-15T20:02:29.887Z", "dateReserved": "2026-03-31T21:06:06.427Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-14T22:25:35.729Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jellyfin", "vendor": "jellyfin", "versions": [{"status": "affected", "version": "< 10.11.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*", "matchCriteriaId": "16256CB1-CEA1-4216-B492-D9016420F60D", "versionEndExcluding": "10.11.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. This is exploitable by any authenticated user because the EnableLiveTvManagement permission defaults to true for all new users. An attacker can chain these vulnerabilities by adding an M3U tuner pointing to an attacker-controlled server, serving a crafted M3U with a channel pointing to the Jellyfin database, exfiltrating the database to extract admin session tokens, and escalating to admin privileges. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can disable Live TV Management privileges for all users."}, {"lang": "es", "value": "Jellyfin es un servidor multimedia de c\u00f3digo abierto autoalojado. Las versiones anteriores a la 10.11.7 contienen una cadena de vulnerabilidades en el punto final del sintonizador M3U de LiveTV (POST /LiveTv/TunerHosts), donde la URL del sintonizador no se valida, permitiendo la lectura de archivos locales a trav\u00e9s de rutas que no son HTTP y la falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) a trav\u00e9s de URL HTTP. Esto es explotable por cualquier usuario autenticado porque el permiso EnableLiveTvManagement se establece en verdadero por defecto para todos los usuarios nuevos. Un atacante puede encadenar estas vulnerabilidades a\u00f1adiendo un sintonizador M3U que apunte a un servidor controlado por el atacante, sirviendo un M3U manipulado con un canal que apunte a la base de datos de Jellyfin, exfiltrando la base de datos para extraer tokens de sesi\u00f3n de administrador y escalando a privilegios de administrador. Este problema ha sido solucionado en la versi\u00f3n 10.11.7. Si los usuarios no pueden actualizar inmediatamente, pueden deshabilitar los privilegios de gesti\u00f3n de Live TV para todos los usuarios."}], "id": "CVE-2026-35032", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35032", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T18:45:46.875262Z", "version": "2.0.3"}}]}, "published": "2026-04-14T23:16:28.660", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.11.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "jellyfin", "source": "cna", "vendor": "jellyfin"}, "product": "jellyfin", "vendor": "jellyfin"}], "analysis": {"en": {"generated_at": "2026-04-14T23:50:19.414861+00:00", "value": {"mitigation_remediation": ["Upgrade Jellyfin to version 10.11.7 or later.", "Disable the Live TV Management privilege for all users if an upgrade cannot occur immediately.", "Configure firewall rules to restrict outbound HTTP/HTTPS traffic from the Jellyfin server to mitigate SSRF by allowing only trusted domains."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary file read and SSRF"}, "threat_synthesis": {"affected_systems": "Vendors and products affected are Jellyfin. All versions older than 10.11.7 are impacted. The vulnerability has been fixed in version 10.11.7.", "description_and_impact": "The vulnerability occurs in Jellyfin\u2019s LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts). The tuner URL is not validated, allowing attackers to supply non\u2011HTTP paths for local file read as well as HTTP URLs that trigger Server\u2011Side Request Forgery. Because the EnableLiveTvManagement permission defaults to true for new users, any authenticated user can exploit this flaw. The flaw exposes the Jellyfin database, potentially leaking admin session tokens and enabling privilege escalation. The weakness is categorized as CWE\u201173 (Unvalidated Path Manipulation) and CWE\u2011918 (Server\u2011Side Request Forgery).", "risk_and_exploitability": "The flaw carries a CVSS score of 8.6, indicating a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently actively exploited in the wild. However, the attack vector is relatively simple for an authenticated user, requiring only the ability to add an M3U tuner. An attacker can create a chain by pointing a tuner to an attacker\u2011controlled server that serves a crafted M3U file with a channel referencing the Jellyfin database, exfiltrate that database, and then leverage extracted admin session tokens to gain administrative privileges. Because the flaw combines SSRF with local file read, the potential impact on confidentiality, integrity, and availability is significant if not mitigated promptly."}}}}, "created": "2026-04-15T13:48:23.615905+00:00", "updated": "2026-04-15T14:31:57.024012+00:00", "vendors": ["jellyfin", "jellyfin$PRODUCT$jellyfin"]}