Description
Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion code path. SubtitleEncoder.ConvertTextSubtitleToSrtInternal (SubtitleEncoder.cs, line 382) interpolates the subtitle file path into FFmpeg command-line arguments without calling EncodingUtils.NormalizePath(). On Linux, filenames can contain double-quote characters, which break the argument quoting and allow injection of arbitrary FFmpeg arguments. The vulnerability is reachable without authentication via SubtitleController.GetSubtitle, which has no [Authorize] attribute. An attacker who can place a file in a Jellyfin media library directory (shared NAS, Samba share, guest upload) can achieve arbitrary file write on the server and information disclosure. This vulnerability is fixed in 10.11.10.
Severity (CVSS)
| Base score | 8.8 |
|---|---|
| Severity | High |
| Version | CVSS 3.1 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Provided by | CNA |
Weaknesses
- CWE-88 — CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products
| Vendor | Product | Versions |
|---|---|---|
| jellyfin | jellyfin | < 10.11.10 |
References
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wwwm-px48-fpvq (x_refsource_CONFIRM)
Generated from the official CVE List on 25 Jun 2026 10:14 UTC.