{"id":"CVE-2026-126499","kind":"vulnerability","aliases":["CVE-2026-126499"],"related":[],"title":"Jellyfin: unvalidated library names let attackers delete or move directories","description":"Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.","summary":"Jellyfin before 12.0 does not validate library names in its DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. Before setup completes, an unauthenticated attacker can send names such as .. or absolute paths to recursively delete the data directory and jellyfin.db.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jellyfin","media-server","runtime","self-hosted"],"not_affected_if":["setup-completed","version-12.0-or-later"],"how_to_check":"- Check the installed Jellyfin version with the server's dashboard (Dashboard > About) and compare it with `12.0`.\n- Look for servers where the setup wizard has not been completed, since the sources describe unauthenticated access before setup finishes.","fix":"- Upgrade Jellyfin to `12.0` or later, per the sources' 'before 12.0' range.","status":"open","published_at":"2026-11-11T01:17:14+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","triaged_at":"2026-11-11T01:25:50+00:00","updated_at":"2026-11-11T01:25:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T01:25:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Jellyfin to `12.0` or later, per the sources' 'before 12.0' range.","reach":"network","title":"Jellyfin: unvalidated library names let attackers delete or move directories","impact":"high","summary":"Jellyfin before 12.0 does not validate library names in its DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. Before setup completes, an unauthenticated attacker can send names such as .. or absolute paths to recursively delete the data directory and jellyfin.db.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["jellyfin","self-hosted","media-server"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated attacker deletes the data directory and jellyfin.db","analyst_note":"Confirm whether authentication is required after setup completes, and read the vendor advisory and release notes linked from the sources for exact fixed-version ranges.","how_to_check":"- Check the installed Jellyfin version with the server's dashboard (Dashboard > About) and compare it with `12.0`.\n- Look for servers where the setup wizard has not been completed, since the sources describe unauthenticated access before setup finishes.\n- unknown for any other check, as the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-12.0-or-later","setup-completed"],"who_is_affected":"Jellyfin servers below 12.0 that are reachable from the network and have not finished initial setup are exposed to unauthenticated deletion of their data directory. Servers already set up appear to require the library endpoints to be reached in a way the sources do not detail, so whether authentication is required after setup is unknown. Teams running Jellyfin in managed hosting still need to confirm the version their provider runs.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000805,"input_tokens":4657,"output_tokens":679,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126499':13A,16A '-2026':12A,15A '/library/virtualfolders':36B,74C '/library/virtualfolders/name':39B,77C '12.0':27B,65C 'absolut':53B,98C 'allow':80C 'attack':6A,46B,81C,92C 'complet':43B,102C 'contain':66C 'cve':11A,14A 'data':59B,107C 'delet':7A,35B,57B,73C,83C,105C 'directori':10A,60B,86C,108C 'endpoint':40B,78C 'host':24B 'jellyfin':1A,17B,25B,63C 'jellyfin.db':62B,110C 'let':5A 'librari':3A,31B,89C 'like':96C 'media':19B 'media-serv':18B 'move':9A,85C 'name':4A,32B,49B,90C,95C 'path':54B,68C,99C 'post':38B,76C 'recurs':56B,104C 'runtim':21B 'self':23B 'self-host':22B 'send':48B 'server':20B 'setup':42B,101C 'suppli':94C 'travers':69C 'unauthent':45B,91C 'unvalid':2A,88C 'valid':30B 'via':87C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Jellyfin servers below 12.0 that are reachable from the network and have not finished initial setup are exposed to unauthenticated deletion of their data directory. Servers already set up appear to require the library endpoints to be reached in a way the sources do not detail, so whether authentication is required after setup is unknown. Teams running Jellyfin in managed hosting still need to confirm the version their provider runs.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","jellyfin","mediaserver","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126499':13A,16A '-2026':12A,15A 'attack':6A 'cve':11A,14A 'delet':7A 'directori':10A 'jellyfin':1A 'let':5A 'librari':3A 'move':9A 'name':4A 'unvalid':2A","search_b":"'/library/virtualfolders':36B '/library/virtualfolders/name':39B '12.0':27B 'absolut':53B 'attack':46B 'complet':43B 'data':59B 'delet':35B,57B 'directori':60B 'endpoint':40B 'host':24B 'jellyfin':17B,25B 'jellyfin.db':62B 'librari':31B 'media':19B 'media-serv':18B 'name':32B,49B 'path':54B 'post':38B 'recurs':56B 'runtim':21B 'self':23B 'self-host':22B 'send':48B 'server':20B 'setup':42B 'unauthent':45B 'valid':30B","search_c":"'/library/virtualfolders':74C '/library/virtualfolders/name':77C '12.0':65C 'absolut':98C 'allow':80C 'attack':81C,92C 'complet':102C 'contain':66C 'data':107C 'delet':73C,83C,105C 'directori':86C,108C 'endpoint':78C 'jellyfin':63C 'jellyfin.db':110C 'librari':89C 'like':96C 'move':85C 'name':90C,95C 'path':68C,99C 'post':76C 'recurs':104C 'setup':101C 'suppli':94C 'travers':69C 'unauthent':91C 'unvalid':88C 'via':87C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-22T01:21:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126499","severity":null,"published_at":"2026-11-11T01:17:14+00:00","modified_at":"2026-11-11T01:17:15+00:00","first_seen_at":"2026-11-11T01:24:34+00:00","fetched_at":"2026-11-11T01:24:34+00:00","note":null}],"documents":[{"id":121283,"url":"https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":121284,"url":"https://github.com/jellyfin/jellyfin/releases/tag/v12.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":121285,"url":"https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-22T01:21:43+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":121286,"url":"https://www.vulncheck.com/advisories/jellyfin-before-12.0-path-traversal-via-library-virtualfolders-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}