jellyfin
vulnerable target service
Runs Jellyfin 10.10.3, exposes port 8096 mapped to host port 8112, mounts named volumes for config/cache and a bind mount for lab output, and includes a healthcheck.
CVE-2026-35031-lab/docker-compose.yml:3-22CVE-2026-35031
CRITICAL
Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
Record summary
CVE-2026-35031 has a selected CVSS score of 10.0 (critical); EIP currently links 1 repository PoC and 1 lab environment.
Description
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately remote code execution as root via ld.so.preload. Exploitation requires an administrator account or a user that has been explicitly granted the "Upload Subtitles" permission. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can grant non-administrator users Subtitle upload permissions to reduce attack surface.
Description source: CVE List
Exploitation context
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
jellyfinBrowse jellyfin / jellyfin | CVE List | < 10.11.7 | affected |
Proofs of concept
1Repository PoCs
GitHubkeraattin/CVE-2026-35031Repository PoCby keraattinStars: 0Scanner4 files
Analysis
Technical assessment
The artifact is a Python-based detection script and accompanying documentation for CVE-2026-35031. The script identifies Jellyfin instances and checks their version against the vulnerable range (< 10.11.7) by querying the unauthenticated payload withheld endpoint. It also probes the subtitle upload endpoint to confirm its existence but does not upload any files or attempt to exploit the path traversal vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python detection scanner, a README documentation file, and a requirements file for CVE-2026-35031. The Python script performs only passive version checks and endpoint probing against a user-supplied target; it does not execute any exploit payload, establish persistence, exfiltrate data, or contain concealed harmful behavior. The README describes the vulnerability and remediation steps. No backdoor, trojan, or deceptive payload was observed.
ClassificationScanner
Model confidence98%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The Python script (CVE-2026-35031_Jellyfin_RCE_detector.py) is explicitly described as a 'Detection Script' (line 3) and its behavior is limited to version checking and endpoint probing. It does not contain any code to upload a file, inject a path traversal payload, or execute commands. The README.md provides a technical writeup but the primary executable artifact is a scanner.
CVE-2026-35031_Jellyfin_RCE_detector.py:3CVE-2026-35031_Jellyfin_RCE_detector.py:71-76Requirements
- Target must be running a Jellyfin Media Server instance with the payload withheld endpoint accessible.
CVE-2026-35031_Jellyfin_RCE_detector.py:175-181
Observed behavior
- Queries the payload withheld endpoint to retrieve the Jellyfin version string.
CVE-2026-35031_Jellyfin_RCE_detector.py:175-181 - Parses the version string and compares it against the fixed version 10.11.7 to determine vulnerability.
CVE-2026-35031_Jellyfin_RCE_detector.py:270-275 - Sends OPTIONS and POST requests to the subtitle upload endpoint (payload withheld) to check if it exists, but does not upload any file or include a malicious Format parameter.
CVE-2026-35031_Jellyfin_RCE_detector.py:89-133 - Reports a risk level (CRITICAL, HIGH, etc.) based on the version and endpoint accessibility without performing any exploitation.
CVE-2026-35031_Jellyfin_RCE_detector.py:288-298
Behaviors behind the backdoor verdict
Observables
- Network Endpoint
- Payload withheldThe scanner queries this unauthenticated Jellyfin endpoint to retrieve the server version for vulnerability assessment.
CVE-2026-35031_Jellyfin_RCE_detector.py:175 - Network Endpoint
- Payload withheldThe scanner sends OPTIONS and empty POST requests to this endpoint to check its existence without uploading any payload.
CVE-2026-35031_Jellyfin_RCE_detector.py:89 - Version Check
- Payload withheldThe scanner compares the retrieved Jellyfin version against this fixed version to determine vulnerability.
CVE-2026-35031_Jellyfin_RCE_detector.py:39
What the analysis did not establish
- The evidence includes a README.md with a detailed technical writeup, but the primary executable code is a scanner. The Nmap NSE script mentioned in the README is not included in the provided files.
- The analysis is based solely on static review of the provided source code; no dynamic execution or network interaction was performed.
- One file (CVE-2026-35031_Jellyfin_RCE.nse) was omitted from the text evidence and was not reviewed; its content is unknown.
- The review is limited to the supplied text content and does not include dynamic analysis or execution of the script.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
Docker lab environments
1GitHubCVE-2026-35031-lab/docker-compose.yml
system-bliss/vuln-lab-dockerCreated Vuln labCVE-2026-35031Compose · mixed
Analysis
Environment assessment
A Docker Compose environment for reproducing CVE-2026-35031, a path traversal vulnerability in Jellyfin 10.10.3 subtitle upload. It consists of a Jellyfin service and a setup service that automates initial configuration.
CVE-2026-35031-lab/README.md:1-3CVE-2026-35031-lab/docker-compose.yml:1-44Lab assessment
Vulnerability labThe README explicitly states the environment is for reproducing CVE-2026-35031, and the Compose file and setup script are designed to deploy a vulnerable Jellyfin instance and automate configuration for the exploit exercise.
CVE-2026-35031-lab/README.md:1-3CVE-2026-35031-lab/docker-compose.yml:1-44Lab shapeCompose · mixed
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Services and files described by the evidence
setup
automated configurationcredential seeding
Runs setup.sh --configure-only after jellyfin is healthy, authenticates as admin, creates a media library, scans for the test video, and writes runtime.env with ACCESS_TOKEN, USER_ID, and ITEM_ID to the shared lab volume.
CVE-2026-35031-lab/docker-compose.yml:24-38CVE-2026-35031-lab/setup.sh:1-140Dockerfile
image builder
Extends jellyfin/jellyfin:10.10.3, installs ffmpeg and curl, creates a minimal test video at /media/lab/cve-2026-35031.mp4, and sets permissions.
CVE-2026-35031-lab/Dockerfile:1-13How the supplied evidence relates each vulnerability
CVE-2026-35031
Supported by supplied evidence
The lab is explicitly built to reproduce CVE-2026-35031, using the vulnerable Jellyfin 10.10.3 image and providing a path traversal payload in the README that matches the described vulnerability.
CVE-2026-35031-lab/README.md:1-3CVE-2026-35031-lab/README.md:55-70CVE-2026-35031-lab/Dockerfile:1Requirements and sequence described by the evidence
Prerequisites
- Docker and Docker Compose v2 must be installed on the host.
CVE-2026-35031-lab/setup.sh:125-130 - The lab must be started with docker compose up -d --build, which builds the image and runs the setup service.
CVE-2026-35031-lab/README.md:15-17CVE-2026-35031-lab/setup.sh:133-135 - The attacker needs the ACCESS_TOKEN and ITEM_ID from lab/runtime.env after setup completes.
CVE-2026-35031-lab/README.md:27-33
Evidence-described exercise path
- Deploy the lab with docker compose up -d --build and wait for setup to finish.
CVE-2026-35031-lab/README.md:15-17 - Retrieve ACCESS_TOKEN and ITEM_ID from lab/runtime.env.
CVE-2026-35031-lab/README.md:27-33 - Send a POST request to /Videos/<ITEM_ID>/Subtitles with a path traversal payload in the Format field to write a proof file to /tmp.
CVE-2026-35031-lab/README.md:55-70 - Verify the file was written by executing ls and cat inside the jellyfin container.
CVE-2026-35031-lab/README.md:103-108
Behaviors behind the stored safety assessment
No harmful behavior observed
All visible behavior is confined to the lab's own containers and volumes. The exploit writes proof files to /tmp inside the jellyfin container, which is the intended target. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the documented exercise.
CVE-2026-35031-lab/README.md:55-108CVE-2026-35031-lab/docker-compose.yml:1-44What the analysis did not establish
- The packet does not include the actual exploit payload execution or verification results; only the lab setup and instructions are provided.
- The CVE-2026-35031 identifier is not yet present in public NVD or CVE databases at the time of analysis, so the association relies solely on the lab's own claims.
Model interpretation
This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
References
2github.com
https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 github.comConfirmation
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-j2hf-x4q5-47j3