CVE-2023-48702

Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `ProcessStartInfo` via the `ValidateVersion` function. A malicious administrator can setup a network share and supply a UNC path to `/System/MediaEncoder/Path` which points to an executable on the network share, causing Jellyfin server to run the executable in the local context. The endpoint was removed in version 10.8.13.

• CWE-77

• https://github.com/jellyfin/jellyfin/commit/83d2c69516471e2db72d9273c6a04247d0f37c86Patch
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rr9h-w522-cvmrExploit, Vendor Advisory
• https://securitylab.github.com/advisories/GHSL-2023-028_jellyfin/Exploit, Third Party Advisory
• https://github.com/jellyfin/jellyfin/commit/83d2c69516471e2db72d9273c6a04247d0f37c86Patch
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rr9h-w522-cvmrExploit, Vendor Advisory
• https://securitylab.github.com/advisories/GHSL-2023-028_jellyfin/Exploit, Third Party Advisory

Published

Dec 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48697Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2023-48698Azure RTOS USBX is a USB host, device, and on-the-go (OTG) e…9.8
• CVE-2023-48699fastbots is a library for fast bot and scraper development u…9.8
• CVE-2023-4870A vulnerability classified as problematic has been found in …6.1
• CVE-2023-48700The Nautobot Device Onboarding plugin uses the netmiko and N…6.5
• CVE-2023-48701Statamic CMS is a Laravel and Git powered content management…6.1
• CVE-2023-48703RobotsAndPencils go-saml, a SAML client library written in G…7.5
• CVE-2023-48704ClickHouse is an open-source column-oriented database manage…7.5
• CVE-2023-48705Nautobot is a Network Source of Truth and Network Automation…5.4
• CVE-2023-48706Vim is a UNIX editor that, prior to version 9.0.2121, has a …4.7
• CVE-2023-48707CodeIgniter Shield is an authentication and authorization pr…6.5
• CVE-2023-48708CodeIgniter Shield is an authentication and authorization pr…6.5