CVE-2023-48702 Jellyfin Possible Remote Code Execution via custom FFmpeg binary
A malicious administrator can execute arbitrary code on the Jellyfin server by specifying a UNC path to an executable in the media encoder configuration.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48702?
CVE-2023-48702 is a high-severity command injection vulnerability in jellyfin, published on 13 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `ProcessStartInfo` via the `ValidateVersion` function. A malicious administrator can setup a network share and supply a UNC path to `/System/MediaEncoder/Path` which points to an executable on the network share, causing Jellyfin server to run the executable in the local context. The endpoint was removed in version 10.8.13.
Weakness: CWE-77
Which versions are affected by CVE-2023-48702?
It affects 1 product.
Products include Jellyfin Jellyfin.
How do I fix CVE-2023-48702?
No fix has been published for CVE-2023-48702 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-48702 being exploited?
There is no known exploitation of CVE-2023-48702 in the wild and no public exploit code.
Other vulnerabilities in jellyfin
- CVE-2026-35031 Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- CVE-2026-31852 Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation
- CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
- CVE-2023-30627 jellyfin-web has a stored cross-site scripting vulnerability in devices.js
- CVE-2023-30626 Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution
Sources
Also known as GHSA-rr9h-w522-cvmr.