CVE-2026-48793
- Source
- https://cve.org/CVERecord?id=CVE-2026-48793
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-48793.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-48793
- Aliases
-
- GHSA-wwwm-px48-fpvq
- Published
- 2026-06-24T18:22:18.293Z
- Modified
- 2026-06-26T11:56:59.624673751Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path
- Details
-
Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion code path. SubtitleEncoder.ConvertTextSubtitleToSrtInternal (SubtitleEncoder.cs, line 382) interpolates the subtitle file path into FFmpeg command-line arguments without calling EncodingUtils.NormalizePath(). On Linux, filenames can contain double-quote characters, which break the argument quoting and allow injection of arbitrary FFmpeg arguments. The vulnerability is reachable without authentication via SubtitleController.GetSubtitle, which has no [Authorize] attribute. An attacker who can place a file in a Jellyfin media library directory (shared NAS, Samba share, guest upload) can achieve arbitrary file write on the server and information disclosure. This vulnerability is fixed in 10.11.10.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48793.json", "cwe_ids": [ "CWE-88" ], "cna_assigner": "GitHub_M" }- References