CVE-2026-48793 Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path
Unauthenticated attackers can inject FFmpeg arguments via malicious subtitle filenames, leading to arbitrary file writes and information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48793?
CVE-2026-48793 is a high-severity command injection vulnerability in jellyfin, published on 24 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion code path. SubtitleEncoder.ConvertTextSubtitleToSrtInternal (SubtitleEncoder.cs, line 382) interpolates the subtitle file path into FFmpeg command-line arguments without calling EncodingUtils.NormalizePath(). On Linux, filenames can contain double-quote characters, which break the argument quoting and allow injection of arbitrary FFmpeg arguments. The vulnerability is reachable without authentication via SubtitleController.GetSubtitle, which has no [Authorize] attribute. An attacker who can place a file in a Jellyfin media library directory (shared NAS, Samba share, guest upload) can achieve arbitrary file write on the server and information disclosure. This vulnerability is fixed in 10.11.10.
Weakness: CWE-88
Which versions are affected by CVE-2026-48793?
How do I fix CVE-2026-48793?
No fix has been published for CVE-2026-48793 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-48793 being exploited?
There is no known exploitation of CVE-2026-48793 in the wild and no public exploit code.
Sources
Also known as GHSA-wwwm-px48-fpvq.