CVE-2024-43801 Privilege escalation to admin from a low-privileged user via SVG upload in Jellyfin
Low-privileged users can escalate to admin via stored XSS in SVG profile images if admins view them externally, exposing access tokens.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-43801?
CVE-2024-43801 is a medium-severity cross-site scripting vulnerability in jellyfin, published on 2 Sep 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of the Jellyfin Web UI (e.g. via "view image" in a browser), this malicious SVG file could interact with the browser's LocalStorage and retrieve an AccessToken, which in turn can be used in an API call to elevate the target user to a Jellyfin administrator. The actual attack vector is unlikely to be exploited, as it requires specific actions by the administrator to view the SVG image outside of Jellyfin's WebUI, i.e. it is not a passive attack. The underlying exploit mechanism is solved by PR #12490, which forces attached images (including the potential malicious SVG) to be treated as attachments and thus downloaded by browsers, rather than viewed. This prevents exploitation of the LocalStorage of the browser. This PR has been merged and the relevant code changes are included in release version 10.9.10. All users are advised to upgrade.
Weakness: CWE-200
Which versions are affected by CVE-2024-43801?
It affects 1 product.
Products include Jellyfin Jellyfin.
How do I fix CVE-2024-43801?
No fix has been published for CVE-2024-43801 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-43801 being exploited?
There is no known exploitation of CVE-2024-43801 in the wild and no public exploit code.
Other vulnerabilities in jellyfin
- CVE-2026-35031 Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- CVE-2026-31852 Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation
- CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
- CVE-2023-30627 jellyfin-web has a stored cross-site scripting vulnerability in devices.js
- CVE-2023-30626 Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution
Sources
Also known as GHSA-vcmh-9wx9-rfqh.