CVE-2026-48793: Jellyfin FFmpeg Argument Injection RCE

CVE-2026-48793 Overview

CVE-2026-48793 is an FFmpeg argument injection vulnerability in Jellyfin, an open source self-hosted media server. Versions prior to 10.11.10 interpolate subtitle file paths into FFmpeg command-line arguments without sanitization in SubtitleEncoder.ConvertTextSubtitleToSrtInternal. On Linux, filenames can contain double-quote characters that break argument quoting and inject arbitrary FFmpeg options. The vulnerable endpoint SubtitleController.GetSubtitle lacks an [Authorize] attribute, making the issue reachable without authentication. An attacker who can place a file in a Jellyfin media library directory can achieve arbitrary file write and information disclosure on the server.

Critical Impact
Unauthenticated attackers with file placement access to a media library can inject FFmpeg arguments to write arbitrary files and disclose sensitive data on the server.

Affected Products

Jellyfin media server versions prior to 10.11.10
Linux-based Jellyfin deployments where filenames may contain double-quote characters
Deployments exposing media libraries via shared NAS, Samba shares, or guest upload paths

Discovery Timeline

2026-06-24 - CVE-2026-48793 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-48793

Vulnerability Analysis

The flaw is an argument injection issue [CWE-88] in the Jellyfin subtitle conversion code path. When Jellyfin needs to convert a text subtitle to SRT format, SubtitleEncoder.ConvertTextSubtitleToSrtInternal in SubtitleEncoder.cs at line 382 builds an FFmpeg command line by interpolating the subtitle file path directly into the arguments string. The code omits a call to EncodingUtils.NormalizePath(), which would normally escape or reject hostile characters.

On Linux file systems, filenames may legally contain double-quote characters. An attacker who controls a filename can close the quoted argument and append additional FFmpeg flags. FFmpeg supports options that read and write arbitrary files, allowing the attacker to pivot argument injection into file system effects on the Jellyfin host.

Root Cause

The root cause is missing input normalization before string interpolation into a shell argument context. The subtitle file path flows from the media library scanner into the FFmpeg argument builder without quoting-aware escaping. Combined with permissive Linux filename rules, this lets attacker-controlled filename bytes alter the structure of the command line passed to FFmpeg.

Attack Vector

Exploitation requires the attacker to place a specially named file inside a directory that Jellyfin scans as part of its media library. Common entry points include shared NAS volumes, Samba shares with guest write access, and any upload feature that preserves user-supplied filenames. Once the file is indexed, the attacker triggers conversion by calling SubtitleController.GetSubtitle. Because that controller method has no [Authorize] attribute, no Jellyfin account is required. FFmpeg then executes with attacker-injected arguments, producing arbitrary file write and information disclosure on the server.

No public exploit code is currently listed in the advisory. Refer to the GitHub Security Advisory GHSA-wwwm-px48-fpvq for the upstream technical write-up.

Detection Methods for CVE-2026-48793

Indicators of Compromise

Files in Jellyfin media library directories with double-quote characters or FFmpeg flag-like substrings (for example " -y -f) embedded in their names.
Unexpected FFmpeg child processes spawned by the Jellyfin service with non-standard output paths or -f format overrides.
New or modified files on disk created by the Jellyfin process outside normal transcode and cache directories.

Detection Strategies

Monitor process execution telemetry for the Jellyfin server process spawning ffmpeg with arguments referencing paths outside the configured media, cache, and transcode roots.
Alert on HTTP requests to /Videos/{id}/{mediaSourceId}/Subtitles/... handled by SubtitleController.GetSubtitle from unauthenticated sessions.
Audit media library directories for filenames containing shell-significant characters such as ", backticks, or leading dashes.

Monitoring Recommendations

Forward Jellyfin access logs and host process telemetry to a centralized analytics platform and correlate subtitle endpoint hits with subsequent ffmpeg invocations.
Track file creation events under the Jellyfin service account and flag writes to system directories such as /etc, /root, or web roots.
Review SMB and NFS audit logs for write activity by anonymous or guest principals into directories indexed by Jellyfin.

How to Mitigate CVE-2026-48793

Immediate Actions Required

Upgrade Jellyfin to version 10.11.10 or later, which adds path normalization in the subtitle conversion code path.
Restrict write access to media library directories so that only trusted accounts can create or rename files.
Disable anonymous and guest write access on Samba and NFS shares mounted into Jellyfin media paths.
Audit existing media libraries for filenames containing double-quote characters and quarantine suspicious entries before upgrading.

Patch Information

The vulnerability is fixed in Jellyfin 10.11.10. The patch ensures the subtitle file path is processed through EncodingUtils.NormalizePath() before being interpolated into FFmpeg arguments. Full details and the patch commit are referenced in the Jellyfin Security Advisory GHSA-wwwm-px48-fpvq.

Workarounds

Place a reverse proxy in front of Jellyfin that blocks unauthenticated requests to subtitle endpoints under SubtitleController until the upgrade is applied.
Run the Jellyfin process under a dedicated low-privilege user with a restrictive file system policy or mandatory access control profile to limit the impact of arbitrary writes.
Mount media library directories read-only where possible, or enforce filename validation at the share level to reject names containing " characters.

bash

# Example: reject filenames with double quotes on a Samba share
# /etc/samba/smb.conf
[media]
   path = /srv/media
   read only = no
   veto files = /*"*/
   delete veto files = yes