CVE-2026-49246 Jellyfin: Potential MKV attachment filename path traversal to RCE
Attackers can achieve remote code execution on Jellyfin media servers by uploading crafted MKV files with malicious attachment filenames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49246?
CVE-2026-49246 is a low-severity path traversal vulnerability in jellyfin, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exploit missing path sanitization during playback. Jellyfin treats the MKV file name tag on MKV attachments as trusted and passes it unsanitized into Path.Combine(attachmentFolder, fileName) inside PathManager.GetAttachmentPath. Because .NET's Path.Combine neither normalises .. nor rejects a rooted second argument, a crafted MKV can redirect Jellyfin's MKV attachment extraction to any absolute path on disk. This triggers on any playback action of the affected video on a client which will attempt to burn in the subtitles by default.g This vulnerability is fixed in 10.11.10.
Weakness: CWE-22
Which versions are affected by CVE-2026-49246?
How do I fix CVE-2026-49246?
No fix has been published for CVE-2026-49246 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49246 being exploited?
There is no known exploitation of CVE-2026-49246 in the wild and no public exploit code.
Sources
Also known as GHSA-f47c-m7gr-q92j.