CVE-2026-35033

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter parsing mechanism. The ParseStreamOptions method in StreamingHelpers.cs adds any lowercase query parameter to a dictionary without validation, bypassing the RegularExpression attribute on the level controller parameter, and the unsanitized value is concatenated directly into the ffmpeg command line. By injecting a drawtext filter with a textfile argument, an attacker can read arbitrary server files such as /etc/shadow and exfiltrate their contents as text rendered in the video stream response. The vulnerable /Videos/{itemId}/stream endpoint has no Authorize attribute, making this exploitable without authentication, though item GUIDs are pseudorandom and require an authenticated user to obtain. This issue has been fixed in version 10.11.7.

• CWE-88
• CWE-862

• https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7Product, Release Notes
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-jh22-fw8w-2v9xVendor Advisory

Published

Apr 14, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35028Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-35029LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…8.8
• CVE-2026-3503Protection mechanism failure in wolfCrypt post-quantum imple…5.2
• CVE-2026-35030LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…9.4
• CVE-2026-35031Jellyfin is an open source self hosted media server. Version…8.8
• CVE-2026-35032Jellyfin is an open source self hosted media server. Version…8.1
• CVE-2026-35034Jellyfin is an open source self hosted media server. Version…6.5
• CVE-2026-35035CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …9
• CVE-2026-35036Ech0 is an open-source, self-hosted publishing platform for …7.5
• CVE-2026-35037Ech0 is an open-source, self-hosted publishing platform for …7.2
• CVE-2026-35038Signal K Server is a server application that runs on a centr…6.5
• CVE-2026-35039fast-jwt provides fast JSON Web Token (JWT) implementation. …9.1