CVE-2026-49247: Jellyfin Path Traversal Vulnerability

CVE-2026-49247 Overview

CVE-2026-49247 is a path traversal vulnerability [CWE-22] in Jellyfin, an open source self-hosted media server. The flaw exists in the POST /ClientLog/Document endpoint between versions 10.9.0 and 10.11.10. The endpoint accepts the Client and Version fields from the Authorization header and uses them unsanitized when constructing the on-disk filename for client-uploaded log documents. Any authenticated non-admin user can inject ../ sequences into the Client field to write attacker-controlled content to arbitrary file system paths reachable by the Jellyfin service user. The maintainers fixed the issue in version 10.11.10.

Critical Impact
Authenticated low-privilege users can write arbitrary content with a forced .log extension to any path accessible by the Jellyfin service account, enabling configuration tampering, log poisoning, and potential code execution paths.

Affected Products

Jellyfin versions 10.9.0 through 10.11.9
Jellyfin self-hosted media server deployments exposing the /ClientLog/Document endpoint
Any Jellyfin instance permitting authenticated non-admin user accounts

Discovery Timeline

2026-06-24 - CVE-2026-49247 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-49247

Vulnerability Analysis

The vulnerability resides in Jellyfin's client log ingestion endpoint, POST /ClientLog/Document. When a client uploads a log document, the server extracts the Client and Version values from the request's Authorization header and concatenates them directly into the filename used to persist the log to disk. No normalization or sanitization is performed on these header-supplied values before they reach file system APIs.

An authenticated attacker holding any non-administrative account can submit a request with a crafted Client field containing ../ sequences. The Jellyfin process then resolves these sequences during path construction and writes the request body to a location outside the intended log directory. The server appends a .log suffix to whatever filename it builds, constraining but not preventing meaningful abuse.

The write occurs under the privileges of the Jellyfin service user. Depending on deployment, that account may have access to configuration files, plugin directories, web roots, or scheduled task definitions. Attackers can leverage the primitive to overwrite or create files that Jellyfin or other system components later read or execute.

Root Cause

The root cause is missing input validation on user-controlled header fields before they are incorporated into file system paths. The endpoint trusts Authorization header metadata as identifier data without treating it as untrusted input subject to path traversal sequences such as ../ and ..\.

Attack Vector

The attack is network-reachable and requires only low-privilege authentication. An attacker sends a POST request to /ClientLog/Document with an Authorization header where the Client field contains directory traversal sequences. The request body contains the content the attacker wishes to write. Jellyfin builds the destination filename from the unsanitized Client value, applies the .log suffix, and writes the body to the resolved path. The forced .log extension limits direct binary execution but still permits overwriting log-monitored files, poisoning telemetry, and writing files into web-accessible or interpreter-reachable directories.

No verified public exploit code is available at the time of publication. See the GitHub Security Advisory GHSA-jg92-mrxq-vv75 for vendor technical details.

Detection Methods for CVE-2026-49247

Indicators of Compromise

HTTP requests to /ClientLog/Document whose Authorization header Client or Version fields contain .., /, \, or URL-encoded equivalents such as %2e%2e%2f.
Unexpected .log files appearing outside the Jellyfin log directory, particularly within configuration, plugin, or web root paths.
File creation events under the Jellyfin service account targeting directories the application does not normally write to.

Detection Strategies

Inspect reverse proxy and application access logs for POST requests to /ClientLog/Document originating from non-administrative accounts at unusual rates.
Parse Authorization header captures for path traversal tokens in the Client or Version parameters.
Correlate authenticated session identifiers with file write telemetry from the Jellyfin host to identify the originating user account.

Monitoring Recommendations

Enable file integrity monitoring on Jellyfin configuration directories, plugin folders, and any web-served paths.
Forward Jellyfin and host audit logs to a centralized analytics platform for correlation of HTTP request patterns with filesystem changes.
Alert on the Jellyfin service account writing .log files outside its designated log directory.

How to Mitigate CVE-2026-49247

Immediate Actions Required

Upgrade all Jellyfin instances to version 10.11.10 or later, which contains the official fix.
Audit existing user accounts and revoke or rotate credentials for any non-admin accounts that should not exist.
Review the Jellyfin log directory tree and broader filesystem for unexpected .log files written since version 10.9.0 was deployed.

Patch Information

The Jellyfin maintainers fixed CVE-2026-49247 in version 10.11.10. The patch sanitizes the Client and Version values extracted from the Authorization header before they are used in filename construction. Refer to the Jellyfin GitHub Security Advisory for the official remediation notice and commit references.

Workarounds

Block or filter requests to /ClientLog/Document at a reverse proxy when traversal sequences appear in the Authorization header until upgrade is possible.
Restrict account creation and limit which network sources can reach authenticated Jellyfin endpoints.
Run the Jellyfin service under a dedicated low-privilege user with filesystem permissions confined to its required data directories.

bash

# Example nginx snippet to reject traversal sequences in the Authorization header
# Place inside the server block fronting Jellyfin
if ($http_authorization ~* "\.\.(/|\\|%2f|%5c)") {
    return 400;
}