keraattin/CVE-2026-35031

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python-based detection script and accompanying documentation for CVE-2026-35031. The script identifies Jellyfin instances and checks their version against the vulnerable range (< 10.11.7) by querying the unauthenticated /System/Info/Public endpoint. It also probes the subtitle upload endpoint to confirm its existence but does not upload any files or attempt to exploit the path traversal vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python detection scanner, a README documentation file, and a requirements file for CVE-2026-35031. The Python script performs only passive version checks and endpoint probing against a user-supplied target; it does not execute any exploit payload, establish persistence, exfiltrate data, or contain concealed harmful behavior. The README describes the vulnerability and remediation steps. No backdoor, trojan, or deceptive payload was observed.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareJellyfin Media Server
Attack typespath traversalarbitrary file writeremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script (CVE-2026-35031_Jellyfin_RCE_detector.py) is explicitly described as a 'Detection Script' (line 3) and its behavior is limited to version checking and endpoint probing. It does not contain any code to upload a file, inject a path traversal payload, or execute commands. The README.md provides a technical writeup but the primary executable artifact is a scanner.

CVE-2026-35031_Jellyfin_RCE_detector.py:3CVE-2026-35031_Jellyfin_RCE_detector.py:71-76

Requirements

  • Target must be running a Jellyfin Media Server instance with the /System/Info/Public endpoint accessible.CVE-2026-35031_Jellyfin_RCE_detector.py:175-181

Observed behavior

  • Queries the /System/Info/Public endpoint to retrieve the Jellyfin version string.CVE-2026-35031_Jellyfin_RCE_detector.py:175-181
  • Parses the version string and compares it against the fixed version 10.11.7 to determine vulnerability.CVE-2026-35031_Jellyfin_RCE_detector.py:270-275
  • Sends OPTIONS and POST requests to the subtitle upload endpoint (/Videos/{itemId}/Subtitles) to check if it exists, but does not upload any file or include a malicious Format parameter.CVE-2026-35031_Jellyfin_RCE_detector.py:89-133
  • Reports a risk level (CRITICAL, HIGH, etc.) based on the version and endpoint accessibility without performing any exploitation.CVE-2026-35031_Jellyfin_RCE_detector.py:288-298
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Endpoint
/System/Info/PublicThe scanner queries this unauthenticated Jellyfin endpoint to retrieve the server version for vulnerability assessment.CVE-2026-35031_Jellyfin_RCE_detector.py:175
Network Endpoint
/Videos/{itemId}/SubtitlesThe scanner sends OPTIONS and empty POST requests to this endpoint to check its existence without uploading any payload.CVE-2026-35031_Jellyfin_RCE_detector.py:89
Version Check
FIXED_VERSION = (10, 11, 7)The scanner compares the retrieved Jellyfin version against this fixed version to determine vulnerability.CVE-2026-35031_Jellyfin_RCE_detector.py:39
Review boundaries

What the analysis did not establish

  • The evidence includes a README.md with a detailed technical writeup, but the primary executable code is a scanner. The Nmap NSE script mentioned in the README is not included in the provided files.
  • The analysis is based solely on static review of the provided source code; no dynamic execution or network interaction was performed.
  • One file (CVE-2026-35031_Jellyfin_RCE.nse) was omitted from the text evidence and was not reviewed; its content is unknown.
  • The review is limited to the supplied text content and does not include dynamic analysis or execution of the script.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1