CVE-2026-126499

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126499
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126499.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126499
Aliases
  • GHSA-6828-c7cx-hvqm
Published
2026-11-11T00:58:51Z
Modified
2026-11-11T10:47:28Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints
Details

Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126499.json"
}
References

Affected packages

Git / github.com/jellyfin/jellyfin

Affected ranges

Type
GIT
Repo
https://github.com/jellyfin/jellyfin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6c073e19ddf604b2369c638716164fdab4c952dc
Fixed
0c560b22ce73323329645b836c9910abc257ce4e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "12.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "0c560b22ce73323329645b836c9910abc257ce4e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v12.0",
            "range": [
                {
                    "fixed": "6c073e19ddf604b2369c638716164fdab4c952dc"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v10.*
v10.0.0
v10.0.1
v10.0.2
v10.11.0-rc1
v10.11.0-rc2
v10.11.0-rc3
v10.11.0-rc4
v10.11.0-rc5
v10.11.0-rc6
v10.11.0-rc7
v10.11.0-rc8
v10.11.0-rc9
v10.4.0
v10.5.0
v10.6.0
v10.8.0-alpha1
v10.8.0-alpha2
v10.8.0-alpha3
v10.8.0-alpha4
v10.8.0-alpha5
v12.*
v12.0-rc1
v12.0-rc2
v12.0-rc3
v12.0-rc4
v12.0-rc5
v12.0-rc6
v12.0-rc7
v3.*
v3.5.2-5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126499.json"