CVE-2026-49246: Jellyfin Path Traversal Vulnerability

CVE-2026-49246 Overview

CVE-2026-49246 is a path traversal vulnerability [CWE-22] affecting Jellyfin, an open source self-hosted media server. Versions prior to 10.11.10 treat the MKV file name tag on MKV attachments as trusted input. The application passes this tag unsanitized into Path.Combine(attachmentFolder, fileName) inside PathManager.GetAttachmentPath. A crafted MKV file containing a forged filename tag can redirect attachment extraction to any absolute path on disk. The flaw triggers during normal playback when a client attempts to burn in subtitles by default.

Critical Impact
An authenticated attacker who can upload or share a malicious MKV file can write attachment data to arbitrary absolute paths on the Jellyfin server during playback.

Affected Products

Jellyfin media server versions prior to 10.11.10
Self-hosted Jellyfin deployments processing user-supplied MKV files
Jellyfin clients that burn in subtitles by default during playback

Discovery Timeline

2026-06-24 - CVE-2026-49246 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-49246

Vulnerability Analysis

The vulnerability resides in Jellyfin's attachment extraction logic for Matroska (MKV) container files. During playback, Jellyfin extracts MKV attachments such as fonts and subtitles to a working directory on disk. The server reads the embedded filename tag from each attachment and uses it to construct a destination path without sanitization.

Because .NET's Path.Combine does not normalize .. traversal sequences and does not reject a rooted second argument, an attacker controls the final destination. Supplying a filename like ../../etc/jellyfin/config.xml traverses out of the attachment folder. Supplying a rooted path like /var/lib/jellyfin/plugins/payload.dll causes Path.Combine to discard the first argument entirely and write directly to that absolute path.

Root Cause

The root cause is missing input validation on attacker-controlled metadata. PathManager.GetAttachmentPath trusts the MKV filename tag as a safe relative path component. No canonicalization, allowlist check, or rooted-path rejection occurs before the path is used for file write operations.

Attack Vector

Exploitation requires that a crafted MKV file be placed in a Jellyfin library and played by any client. The triggering action is automatic subtitle burn-in, which is the default behavior on most clients. The attack is network-reachable but has high attack complexity because it depends on user interaction with the malicious media. No authentication is strictly required if the server permits anonymous library access.

For technical specifics, refer to the Jellyfin GitHub Security Advisory GHSA-f47c-m7gr-q92j.

Detection Methods for CVE-2026-49246

Indicators of Compromise

Unexpected files written outside the Jellyfin attachment cache directory, particularly under paths owned by the Jellyfin service account
MKV files in the media library containing attachment filename tags with .. sequences or absolute path prefixes such as / or C:\
Modifications to Jellyfin configuration files, plugin directories, or scheduled task locations correlated with recent playback events

Detection Strategies

Inspect MKV files using mkvinfo or ffprobe to enumerate attachment filenames and flag any containing path separators or traversal sequences
Monitor file write activity by the Jellyfin process for paths outside its designated transcoding and attachment working directories
Correlate playback events in Jellyfin server logs with file creation events on the host filesystem

Monitoring Recommendations

Enable filesystem auditing on Jellyfin configuration, plugin, and binary directories to detect unauthorized writes
Alert on Jellyfin processes writing to system directories or user home directories outside the configured media and cache paths
Track ingestion of new MKV files and run automated metadata scans before they are exposed to playback

How to Mitigate CVE-2026-49246

Immediate Actions Required

Upgrade Jellyfin to version 10.11.10 or later, which contains the fix for this path traversal flaw
Audit existing media libraries for MKV files with suspicious attachment filename tags
Restrict library upload permissions to trusted users until the upgrade is applied

Patch Information

The vulnerability is fixed in Jellyfin 10.11.10. The patch adds sanitization to reject path traversal sequences and rooted paths before they reach Path.Combine in PathManager.GetAttachmentPath. See the Jellyfin GitHub Security Advisory GHSA-f47c-m7gr-q92j for upgrade guidance.

Workarounds

Disable subtitle burn-in on all clients to prevent automatic attachment extraction during playback
Run the Jellyfin service as an unprivileged user with no write access to system directories, configuration files, or plugin paths
Apply mandatory access controls such as AppArmor or SELinux profiles to confine Jellyfin file writes to its data directory
Remove or quarantine untrusted MKV files from libraries pending upgrade

bash

# Configuration example: restrict Jellyfin write access using systemd
# /etc/systemd/system/jellyfin.service.d/hardening.conf
[Service]
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/jellyfin /var/cache/jellyfin /var/log/jellyfin
NoNewPrivileges=true
PrivateTmp=true