CVE-2026-48793

Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion code path. SubtitleEncoder.ConvertTextSubtitleToSrtInternal (SubtitleEncoder.cs, line 382) interpolates the subtitle file path into FFmpeg command-line arguments without calling EncodingUtils.NormalizePath(). On Linux, filenames can contain double-quote characters, which break the argument quoting and allow injection of arbitrary FFmpeg arguments. The vulnerability is reachable without authentication via SubtitleController.GetSubtitle, which has no [Authorize] attribute. An attacker who can place a file in a Jellyfin media library directory (shared NAS, Samba share, guest upload) can achieve arbitrary file write on the server and information disclosure. This vulnerability is fixed in 10.11.10.

• CWE-88

• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wwwm-px48-fpvq

Published

Jun 24, 2026

Last Modified

Jun 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48784Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-48787gin-vue-admin is an AI-assisted basic development platform. …7.4
• CVE-2026-48788Remark42 is a self-hosted comment engine for blogs, articles…8.2
• CVE-2026-48789AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-48790Turso CLI is the command line interface (CLI) to the open-so…5.5
• CVE-2026-48792pam_usb provides hardware authentication for Linux using ord…4.4
• CVE-2026-48794Authelia is an open-source authentication and authorization …1.3
• CVE-2026-48795AdonisJS is a TypeScript-first web framework. From 10.1.3 un…8.6
• CVE-2026-48797Backpropagate is a Python library for fine-tuning large lang…9.3
• CVE-2026-48799Postiz is an AI social media scheduling tool. Prior to 2.21.…7.7
• CVE-2026-4880The Barcode Scanner (+Mobile App) – Inventory manager, Order…9.8
• CVE-2026-48800Notepad++ is a free and open-source source code editor. Prio…7.8