CVE-2021-21402 — AI Deep Analysis Summary

🚨 **Essence**: Path Traversal in Jellyfin < 10.7.1 allows reading arbitrary files from the server's filesystem. 💥 **Consequences**: Sensitive data exposure, potential system compromise, especially on Windows hosts.

🛡️ **Root Cause**: CWE-22 (Path Traversal). The application fails to properly sanitize user input in URLs, allowing `../` sequences to escape the intended directory.

📦 **Affected**: Jellyfin versions **before 10.7.1**. Components: Media server core handling audio/streaming requests.

🕵️ **Attacker Capabilities**: Read arbitrary files (e.g., config files, source code, credentials). No privilege escalation needed, just file access.

🔓 **Exploitation Threshold**: **Low**. Requires **Local Privileges** (PR:L) but **Low Complexity** (AC:L) and **No User Interaction** (UI:N). Network accessible (AV:N).

💣 **Public Exp?**: **YES**. Multiple PoCs available on GitHub (Python, Wker scripts, Nuclei templates). Easy to automate for batch scanning.

🔍 **Self-Check**: Send crafted GET requests with `..%5C` (URL-encoded backslash) to audio/stream endpoints. Check for `200 OK` and file content (e.g., `win.ini` on Windows).

✅ **Fixed?**: **YES**. Officially patched in **Jellyfin 10.7.1**. Upgrade immediately via official downloads.

🚧 **No Patch Workaround**: Implement strict filesystem permissions on the server. Restrict access to sensitive directories. Not a full fix, but reduces risk.

⚡ **Urgency**: **HIGH**. CVSS Score: **7.5** (High). Public exploits exist. If exposed to the internet, immediate patching is critical.