CVE-2026-48793— Jellyfin 命令注入漏洞

Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path

Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion code path. SubtitleEncoder.ConvertTextSubtitleToSrtInternal (SubtitleEncoder.cs, line 382) interpolates the subtitle file path into FFmpeg command-line arguments without calling EncodingUtils.NormalizePath(). On Linux, filenames can contain double-quote characters, which break the argument quoting and allow injection of arbitrary FFmpeg arguments. The vulnerability is reachable without authentication via SubtitleController.GetSubtitle, which has no [Authorize] attribute. An attacker who can place a file in a Jellyfin media library directory (shared NAS, Samba share, guest upload) can achieve arbitrary file write on the server and information disclosure. This vulnerability is fixed in 10.11.10.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

参数注入或修改

Jellyfin 命令注入漏洞

Jellyfin是Jellyfin团队开源的一款媒体服务器软件。 Jellyfin 10.11.10之前版本存在命令注入漏洞，该漏洞源于字幕转换过程中未对文件路径进行正常化处理，可能导致FFmpeg参数注入，未经身份验证的攻击者通过放置恶意文件可实现任意文件写入和信息泄露。

N/A

N/A