Live › vulnerability › CVE-2026-119549
Jellyfin, the self-hosted media server, fails to validate SVG content hidden inside gzip-compressed data URIs in profile image uploads. An authenticated user can make the server fetch internal URLs, read local image files, or exhaust memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Jellyfin servers through version 12.4 where users can upload profile images. The flaw needs an authenticated account, so servers with open registration or shared accounts are most exposed. Servers limited to trusted users on a private network carry less risk.
No product ranges from the sources yet.
jellyfin --version; affected versions are stated as through 12.4/UserImage endpoint being reachable from untrusted networksEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-119549")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.