CVE-2026-35033 Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
Unauthenticated attackers can inject ffmpeg arguments to read arbitrary server files and potentially execute code via the stream endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35033?
CVE-2026-35033 is a critical command injection vulnerability in jellyfin, published on 14 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any lowercase query parameter to a dictionary without validation, bypassing the RegularExpression attribute on the level controller parameter, and the unsanitized value is concatenated directly into the ffmpeg command line. By injecting a drawtext filter with a textfile argument, an attacker can read arbitrary server files such as /etc/shadow and exfiltrate their contents as text rendered in the video stream response. The vulnerable /Videos/{itemId}/stream endpoint has no Authorize attribute, making this exploitable without authentication, though item GUIDs are pseudorandom and require an authenticated user to obtain. This issue has been fixed in version 10.11.7.
Which versions are affected by CVE-2026-35033?
It affects 1 product.
Products include Jellyfin Jellyfin.
How do I fix CVE-2026-35033?
No fix has been published for CVE-2026-35033 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-35033 being exploited?
There is no known exploitation of CVE-2026-35033 in the wild and no public exploit code.
Other vulnerabilities in jellyfin
- CVE-2026-35031 Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- CVE-2026-31852 Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation
- CVE-2023-30627 jellyfin-web has a stored cross-site scripting vulnerability in devices.js
- CVE-2023-30626 Jellyfin vulnerable to directory traversal and file write causing arbitrary code execution
- CVE-2022-35909 Incorrect Access Control and Cross Site Scripting in Jellyfin
Sources
Also known as GHSA-jh22-fw8w-2v9x.