CVE-2026-126499

CVSS 8.3 (high) · published 2026-11-11

Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.

Weakness: CWE-22

Source: NVD CVE-2026-126499

References

• https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs#L3255-L3275
• https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs#L127-L176
• https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e
• https://github.com/jellyfin/jellyfin/releases/tag/v12.0
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm
• https://www.vulncheck.com/advisories/jellyfin-before-12.0-path-traversal-via-library-virtualfolders-endpoints

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.