Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain

The vulnerability lies in the handling of the 'Format' field during subtitle uploads via the POST /Videos/{itemId}/Subtitles endpoint. Lack of proper validation allows attackers to manipulate the file extension, enabling path traversal. This can be exploited to write arbitrary files to the server's filesystem. A successful exploit can lead to several severe consequences, including the extraction of sensitive database information, escalation to administrator privileges, and ultimately, the execution of arbitrary code as the root user. This represents a significant security risk, potentially allowing an attacker to completely compromise the affected Jellyfin server and any data it hosts. The ability to execute code as root significantly expands the attack surface and potential impact.

Organizations and individuals running self-hosted Jellyfin Media Server instances, particularly those with administrator accounts accessible over the internet, are at significant risk. Shared hosting environments where multiple users share a Jellyfin instance are also vulnerable, as a compromised user account could be leveraged to exploit this vulnerability.

• linux / server:

journalctl -u jellyfin | grep -i "subtitle upload"

• linux / server:

lsof | grep jellyfin | grep /Videos

• generic web:

curl -I http://<jellyfin_server>/Videos/<item_id>/Subtitles -H "Content-Type: multipart/form-data" -d "Format=../../../../../../etc/passwd"

1. 2026-04-14Disclosure

   disclosure

1. 予約済み2026-03-31
2. 公開日2026-04-14
3. 更新日2026-04-16
4. EPSS 更新日2026-04-22

The primary mitigation for CVE-2026-35031 is to immediately upgrade Jellyfin Media Server to version 10.11.7 or later. Prior to upgrading, it is crucial to back up your Jellyfin configuration and database. If an upgrade is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to the /Videos/{itemId}/Subtitles endpoint with suspicious file extensions or path traversal attempts. Monitor server logs for any unusual file write activity or attempts to upload files with manipulated extensions. Restrict access to the subtitle upload endpoint to trusted users only.