---
id: "CVE-2026-126499"
page: "https://infrastack.ai/live/CVE-2026-126499"
kind: "vulnerability"
aliases: ["CVE-2026-126499"]
title: "Jellyfin: unvalidated library names let attackers delete or move directories"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["jellyfin", "media-server", "runtime", "self-hosted"]
not_affected_if: ["setup-completed", "version-12.0-or-later"]
published_at: "2026-11-11T01:17:14+00:00"
first_seen_at: "2026-11-11T01:24:34+00:00"
updated_at: "2026-11-11T01:25:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126499", "first_seen_at": "2026-11-11T01:24:34+00:00"}]
exploit_sources: []
---

# Jellyfin: unvalidated library names let attackers delete or move directories

Link for people: https://infrastack.ai/live/CVE-2026-126499 (this .md is for agents)

Jellyfin before 12.0 does not validate library names in its DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. Before setup completes, an unauthenticated attacker can send names such as .. or absolute paths to recursively delete the data directory and jellyfin.db.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Jellyfin version with the server's dashboard (Dashboard > About) and compare it with `12.0`.
- Look for servers where the setup wizard has not been completed, since the sources describe unauthenticated access before setup finishes.

## Fix

- Upgrade Jellyfin to `12.0` or later, per the sources' 'before 12.0' range.

## Timeline

- 2026-11-11T01:24:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126499

## Documents

- [advisory] Vendor advisory: github.com https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/jellyfin-before-12.0-path-traversal-via-library-virtualfolders-endpoints
- [fix] Patch: github.com https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e
- [fix] Release notes: github.com https://github.com/jellyfin/jellyfin/releases/tag/v12.0

## From the sources

Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_