CVE-2026-35031: Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jellyfinto a version that resolves this vulnerability.Fixed in 10.11.7 - Configuration
If you cannot upgrade immediately, grant the "Upload Subtitles" permission only to non-administrator users that must upload subtitles, and avoid granting it to other users to reduce attack surface.
Jellyfin Subtitle upload permission (Upload Subtitles) = grant only to explicitly required non-administrator users; do not grant to users unless needed
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35031?
CVE-2026-35031 is considered a critical vulnerability due to its potential for remote code execution through unauthorized subtitle uploads.
How do I fix CVE-2026-35031?
To fix CVE-2026-35031, upgrade Jellyfin to version 10.11.7 or later.
What is the impact of exploiting CVE-2026-35031?
Exploiting CVE-2026-35031 may allow an attacker to execute arbitrary code on the server through crafted subtitle files.
Which versions of Jellyfin are affected by CVE-2026-35031?
Jellyfin versions prior to 10.11.7 are affected by CVE-2026-35031.
What is the attack vector for CVE-2026-35031?
The attack vector for CVE-2026-35031 involves the subtitle upload endpoint and path traversal vulnerabilities.