CVE-2026-119549 Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

High 7.1 Published 30 Oct 2026 Updated 30 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119549?

CVE-2026-119549 is a high-severity vulnerability in jellyfin, published on 30 Oct 2026.

Official description

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.

Weakness: CWE-918

Which versions are affected by CVE-2026-119549?

How do I fix CVE-2026-119549?

No fix has been published for CVE-2026-119549 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119549 being exploited?

There is no known exploitation of CVE-2026-119549 in the wild and no public exploit code.

Sources

Also known as GHSA-5hqc-9wxw-2gfq, GHSA-cf3c-8m59-2vhx.