CVE-2021-29490

Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image` and `/Images/Remote` via reverse proxy, or limit to known-friendly IPs.

• CWE-918

• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rgjw-4fwc-9v96Patch, Third Party Advisory
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rgjw-4fwc-9v96Patch, Third Party Advisory

Published

May 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29484Ghost is a Node.js CMS. An unused endpoint added during the …6.8
• CVE-2021-29485Ratpack is a toolkit for creating web applications. In versi…8.8
• CVE-2021-29486cumulative-distribution-function is an open source npm libra…7.5
• CVE-2021-29487octobercms in a CMS platform based on the Laravel PHP Framew…7.4
• CVE-2021-29488SABnzbd is an open source binary newsreader. A vulnerability…5.3
• CVE-2021-29489Highcharts JS is a JavaScript charting library based on SVG.…5.4
• CVE-2021-29491Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-29492Envoy is a cloud-native edge/middle/service proxy. Envoy doe…8.3
• CVE-2021-29493Kennnyshiwa-cogs contains cogs for Red Discordbot. An RCE ex…8.8
• CVE-2021-29495Nim is a statically typed compiled systems programming langu…7.5
• CVE-2021-29499SIF is an open source implementation of the Singularity Cont…7.5
• CVE-2021-29500bubble fireworks is an open source java package relating to …7.5