CVE-2026-35031

The POST /Videos/{itemId}/Subtitles endpoint does not verify the Format field, which allows path traversal through manipulation of the file extension and writing arbitrary files to the server's file system. The written file can then be read through .strm files, enabling database extraction and privilege escalation to administrator level. Finally, the attacker can write their own library to ld.so.preload, achieving remote code execution with root privileges.

An attacker can gain full control over the server, including reading arbitrary files, extracting data from the database, privilege escalation, and remote code execution as root (RCE).

Jellyfin should be updated to version 10.11.7 or newer. If immediate update is not possible, it is recommended not to grant unprivileged users the 'Upload Subtitles' permission to reduce the attack surface.

Jellyfin in versions earlier than 10.11.7. Exploitation requires an administrator account or a user account with explicitly granted 'Upload Subtitles' permission.