CVE-2026-126499 · Runtime
NO FIX YET · SEE WHAT TO DO
Jellyfin before 12.0 does not validate library names in its DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. Before setup completes, an unauthenticated attacker can send names such as .. or absolute paths to recursively delete the data directory and jellyfin.db.
first public Sep 22, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Jellyfin servers below 12.0 that are reachable from the network and have not finished initial setup are exposed to unauthenticated deletion of their data directory. Servers already set up appear to require the library endpoints to be reached in a way the sources do not detail, so whether authentication is required after setup is unknown. Teams running Jellyfin in managed hosting still need to confirm the version their provider runs.
Not affected if setup-completed, version-12.0-or-later
Who cares jellyfin, media-server, self-hosted
12.0.12.0 or later, per the sources' 'before 12.0' range.Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.