CVE-2026-49246: Jellyfin: Potential MKV attachment filename path traversal to RCE
Jellyfin is an open source self hosted media server. Prior to 10.11.10, a specifically crafted MKV file containing forged filename tags can be leveraged to exploit missing path sanitization during playback. Jellyfin treats the MKV file name tag on MKV attachments as trusted and passes it unsanitized into Path.Combine(attachmentFolder, fileName) inside PathManager.GetAttachmentPath. Because .NET's Path.Combine neither normalises .. nor rejects a rooted second argument, a crafted MKV can redirect Jellyfin's MKV attachment extraction to any absolute path on disk. This triggers on any playback action of the affected video on a client which will attempt to burn in the subtitles by default.g This vulnerability is fixed in 10.11.10.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Jellyfinto a version that resolves this vulnerability.Fixed in 10.11.10 - Compensating control
Until upgraded, restrict access so clients cannot trigger playback of affected MKV files (e.g., block untrusted MKV uploads/paths or deny playback to clients/users who could supply crafted MKVs).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49246?
CVE-2026-49246 has a risk rating of 76, indicating a high severity threat.
How do I fix CVE-2026-49246?
To fix CVE-2026-49246, update Jellyfin to version 10.11.10 or later, which includes the necessary path sanitization improvements.
What vulnerability does CVE-2026-49246 describe?
CVE-2026-49246 describes a potential path traversal vulnerability in Jellyfin that can lead to remote code execution via specially crafted MKV attachments.
Which versions of Jellyfin are affected by CVE-2026-49246?
Jellyfin versions prior to 10.11.10 are affected by CVE-2026-49246.
What type of attack is CVE-2026-49246 associated with?
CVE-2026-49246 is associated with a path traversal attack that exploits unsanitized filename tags in MKV attachments.