CVE-2026-35031: Jellyfin remote code execution (CVSS 9.9)

Description

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Jellyfin< 10.11.7

Remediation

Fixed in

Jellyfin≥ 10.11.7

Patch & vendor advisories

https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3

References

https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7ProductRelease Notes
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3MitigationVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-35031 being actively exploited?

CVE-2026-35031 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.92%.

How severe is CVE-2026-35031?

CVE-2026-35031 has a CVSS 3.1 base score of 9.9, rated critical. EPSS estimates a 0.92% probability of exploitation.

Which products are affected by CVE-2026-35031?

Affected products include Jellyfin.

How do I fix CVE-2026-35031?

Upgrade affected software to a fixed version, for example Jellyfin 10.11.7 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-35031 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo