CVE-2026-35031

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface.

• CWE-20
• CWE-22
• CWE-187

• https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7Product, Release Notes
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3Mitigation, Vendor Advisory

Published

Apr 14, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35026Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-35027Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-35028Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-35029LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…8.8
• CVE-2026-3503Protection mechanism failure in wolfCrypt post-quantum imple…5.2
• CVE-2026-35030LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…9.4
• CVE-2026-35032Jellyfin is an open source self hosted media server. Version…8.1
• CVE-2026-35033Jellyfin is an open source self hosted media server. Version…9.1
• CVE-2026-35034Jellyfin is an open source self hosted media server. Version…6.5
• CVE-2026-35035CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …9
• CVE-2026-35036Ech0 is an open-source, self-hosted publishing platform for …7.5
• CVE-2026-35037Ech0 is an open-source, self-hosted publishing platform for …7.2