CVE-2021-29490mediumCWE-918

CVE-2021-29490: medium-severity vulnerability in jellyfin

Unauthenticated GET requests through Remote Image endpoints

Published · Updated

Follow this CVE+ Monitor jellyfin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 5.8epss 72%
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image` and `/Images/Remote` via reverse proxy, or limit to known-friendly IPs.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Affected products
jellyfin · jellyfin
Related CVEs — jellyfin

In the same product, most dangerous first.

CVE-2021-21402HIGHUnauthenticated Arbitrary File Access in JellyfinEPSS 79.3%CVE-2023-30626HIGHJellyfin vulnerable to directory traversal and file write causing arbitrary code executionEPSS 2.0%CVE-2023-49096HIGHArgument Injection in FFmpeg codec parameters in JellyfinEPSS 1.3%CVE-2023-48702HIGHJellyfin Possible Remote Code Execution via custom FFmpeg binaryEPSS 1.2%CVE-2025-31499HIGHJellyfin Vulnerable to Argument Injection in FFmpegEPSS 0.8%CVE-2025-32012MEDIUMJellyfin Vulnerable to Denial of Service (DoS) via IP SpoofingEPSS 0.8%