CVE-2026-49247: Jellyfin Path Traversal Arbitrary File Write Vulnerability

Technical summary

The vulnerability stems from insufficient input validation in the POST /ClientLog/Document endpoint. The Authorization header's Client and Version fields are directly interpolated into the server-side filename without sanitization, then written to disk with a forced .log extension. An authenticated attacker can embed path traversal sequences (../) within the Client field to escape the intended log directory and write to arbitrary paths reachable by the Jellyfin service user. This is a classic CWE-22 path traversal flaw that converts a file write operation with limited scope into an arbitrary file write primitive. The .log suffix constraint is bypassable or inconsequential for many attack scenarios.

Business impact

This vulnerability poses significant operational risk for organizations running self-hosted Jellyfin instances. An insider threat or compromised low-privilege account can overwrite configuration files, inject malicious code into executable paths, or corrupt service-critical data. If Jellyfin runs with elevated privileges or in a shared container, lateral movement and further compromise become possible. Media libraries and user data may be corrupted, and service availability can be compromised. For enterprises using Jellyfin in production environments, this represents a direct path from user compromise to infrastructure compromise.

Affected systems

Jellyfin versions 10.9.0 through 10.11.9 (inclusive) are affected. Version 10.11.10 and later contain the fix. Deployments on all operating systems are vulnerable during the affected version range, including Docker containers, bare metal installs, and cloud-hosted instances. Any deployment where non-admin users have valid authentication credentials is at risk.

Exploitability

The vulnerability requires valid authentication but does not require admin privileges, making it accessible to any user account—including those created for family members, friends, or low-trust scenarios common in personal media server deployments. The attack is trivial to execute: a standard HTTP POST request with a crafted Authorization header is sufficient. No user interaction is required. The barrier to exploitation is low, and proof-of-concept code would be straightforward to develop. This is a high-confidence, high-impact finding.

Remediation

Immediate action: upgrade Jellyfin to version 10.11.10 or later. For environments unable to upgrade immediately, restrict authentication to trusted users only and disable the client logging feature if it is not essential. Monitor the /ClientLog/Document endpoint for suspicious requests. Review file system permissions to ensure the Jellyfin service user has minimal write access beyond its intended directories. Verify that no sensitive files were written to unexpected locations during the affected period.

Patch guidance

Upgrade Jellyfin to version 10.11.10 or the latest stable release available. Verify the version after patching by checking the System/About endpoint or the admin dashboard. Test the upgrade in a non-production environment first if possible to confirm compatibility with your configuration and plugins. After patching, review recent log locations and permissions to rule out exploitation.

Detection guidance

Search logs for POST requests to /ClientLog/Document with Authorization headers containing ../ sequences in the Client field. Monitor the Jellyfin process for unexpected file write activity outside the designated log directory using file system monitoring or auditd. Check for .log files in unexpected locations (e.g., outside the configured log directory or in sensitive directories like configuration or plugin paths). Review HTTP access logs for 201/204 responses to the /ClientLog/Document endpoint from non-admin authenticated sessions. Enable debug logging in Jellyfin to capture full request details.

Why prioritize this

This vulnerability scores 8.8 CVSS (HIGH) due to its combination of network accessibility, low attack complexity, low privilege requirement, and severe impact (confidentiality, integrity, and availability all affected). While not yet confirmed in active exploitation or KEV listing, the trivial exploitability, broad applicability, and direct path to code execution or data corruption make it a priority-one remediation target. Organizations running Jellyfin should treat this as urgent.

Risk score, explained

CVSS 3.1 8.8 (HIGH): AV:N (network-accessible), AC:L (no special conditions required), PR:L (requires valid user account but not admin), UI:N (no user interaction needed), S:U (no scope change), C:H/I:H/A:H (all three impact categories maximized). The scoring reflects the serious nature of arbitrary file write with authentication bypass of the admin-only protection. The high impact rating is justified because the attacker can corrupt, exfiltrate, or destroy data and potentially achieve code execution.

Frequently asked questions