CVE-2026-49246

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49246
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-49246.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-49246
Aliases
  • GHSA-f47c-m7gr-q92j
Published
2026-06-24T18:21:25.846Z
Modified
2026-06-27T11:55:04.087309612Z
Severity
  • 1.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
Jellyfin: Potential MKV attachment filename path traversal to RCE
Details

Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exploit missing path sanitization during playback. Jellyfin treats the MKV file name tag on MKV attachments as trusted and passes it unsanitized into Path.Combine(attachmentFolder, fileName) inside PathManager.GetAttachmentPath. Because .NET's Path.Combine neither normalises .. nor rejects a rooted second argument, a crafted MKV can redirect Jellyfin's MKV attachment extraction to any absolute path on disk. This triggers on any playback action of the affected video on a client which will attempt to burn in the subtitles by default.g This vulnerability is fixed in 10.11.10.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49246.json",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/jellyfin/jellyfin

Affected ranges

Type
GIT
Repo
https://github.com/jellyfin/jellyfin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4b4b4cd94d8d3fe20b2b2b576edbc5cfa933fe07
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "10.11.10"
        }
    ]
}

Affected versions

v10.*
v10.0.0
v10.0.1
v10.0.2
v10.11.0
v10.11.0-rc1
v10.11.0-rc2
v10.11.0-rc3
v10.11.0-rc4
v10.11.0-rc5
v10.11.0-rc6
v10.11.0-rc7
v10.11.0-rc8
v10.11.0-rc9
v10.11.1
v10.11.2
v10.11.3
v10.11.4
v10.11.5
v10.11.6
v10.11.7
v10.11.8
v10.11.9
v10.4.0
v10.5.0
v10.6.0
v10.8.0-alpha1
v10.8.0-alpha2
v10.8.0-alpha3
v10.8.0-alpha4
v10.8.0-alpha5
v3.*
v3.5.2-5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-49246.json"