CVE-2021-29490 Unauthenticated GET requests through Remote Image endpoints
Unauthenticated attackers can perform Server-Side Request Forgery via the imageUrl parameter, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-29490?
CVE-2021-29490 is a medium-severity server-side request forgery vulnerability in jellyfin, published on 5 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image` and `/Images/Remote` via reverse proxy, or limit to known-friendly IPs.
Weakness: CWE-918
Which versions are affected by CVE-2021-29490?
It affects 1 product.
Products include Jellyfin Jellyfin.
How do I fix CVE-2021-29490?
No fix has been published for CVE-2021-29490 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-29490 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-29490 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in jellyfin
- CVE-2026-35031 Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- CVE-2026-31852 Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation
- CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
- CVE-2023-30627 jellyfin-web has a stored cross-site scripting vulnerability in devices.js
- CVE-2023-30626 Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution
Sources
Also known as GHSA-rgjw-4fwc-9v96.