← Database

CVE-2026-119549

HIGH CVSS: 7.1 Published: 2026-10-30 Modified: 2026-10-30

Description

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.

Affected Platforms

Unknown

Weakness Type

CWE-918

References