CVE-2026-126499
7.4 HIGHpublic exploit availablePublished 2026-11-11 · Updated 2026-11-11
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-22
Public exploit & PoC references
- https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs#L3255-L3275
- https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs#L127-L176
- https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e
- https://github.com/jellyfin/jellyfin/releases/tag/v12.0
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm
All references
- https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs#L3255-L3275
- https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs#L127-L176
- https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e
- https://github.com/jellyfin/jellyfin/releases/tag/v12.0
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm
- https://www.vulncheck.com/advisories/jellyfin-before-12.0-path-traversal-via-library-virtualfolders-endpoints
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2012-20002PoC
- HIGHCVE-2014-125130PoC
- HIGHCVE-2014-125133PoC
- HIGHCVE-2014-125134PoC
- HIGHCVE-2015-20123PoC
- HIGHCVE-2015-20124PoC
- HIGHCVE-2015-20125PoC
- HIGHCVE-2016-20100PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.