jellyfin vulnerabilities
CVEs whose affected-version data names the jellyfin package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-119549High· 7.1Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images vi…
CVE-2026-119551Medium· 6.5Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. …
CVE-2026-119550Low· 3.5Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled…