{"id":"CVE-2026-119549","title":"Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images","summary":"Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images vi…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-918"],"vendor":"jellyfin","product":"jellyfin","affected":["jellyfin <= 12.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T16:11:09.213684Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T16:11:21.944Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119549","references":[{"url":"https://github.com/jellyfin/jellyfin/blob/v12.4/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs#L169-L173"},{"url":"https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/ImageController.cs#L96"},{"url":"https://github.com/jellyfin/jellyfin/security/advisories/GHSA-cf3c-8m59-2vhx","label":"GitHub Security Advisory (GHSA-cf3c-8m59-2vhx)"},{"url":"https://abraxaslabs.tech/research/jellyfin-svg-gzip"},{"url":"https://github.com/jellyfin/jellyfin"},{"url":"https://www.vulncheck.com/advisories/jellyfin-through-12.4-ssrf-via-gzip-compressed-data-uri-in-svg-profile-images","label":"VulnCheck Advisory: Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images"}],"tags":["cve.org"],"epss":0.0044,"epssPercentile":0.38377,"ingestedAt":"2026-11-05T16:24:31.061Z","slug":"CVE-2026-119549","body":"## Overview\n\nJellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.\n\n## Affected\n\n- `jellyfin <= 12.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}