CVE-2023-48702: falha de alta gravidade em jellyfin
Jellyfin Possible Remote Code Execution via custom FFmpeg binary
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 1.2%
Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `ProcessStartInfo` via the `ValidateVersion` function. A malicious administrator can setup a network share and supply a UNC path to `/System/MediaEncoder/Path` which points to an executable on the network share, causing Jellyfin server to run the executable in the local context. The endpoint was removed in version 10.8.13.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
jellyfin · jellyfinCVEs relacionadas — jellyfin
No mesmo produto, das mais perigosas para as menos.
CVE-2021-21402HIGHUnauthenticated Arbitrary File Access in JellyfinEPSS 79.3%CVE-2021-29490MEDIUMUnauthenticated GET requests through Remote Image endpointsEPSS 71.7%CVE-2023-30626HIGHJellyfin vulnerable to directory traversal and file write causing arbitrary code executionEPSS 2.0%CVE-2023-49096HIGHArgument Injection in FFmpeg codec parameters in JellyfinEPSS 1.3%CVE-2025-31499HIGHJellyfin Vulnerable to Argument Injection in FFmpegEPSS 0.8%CVE-2025-32012MEDIUMJellyfin Vulnerable to Denial of Service (DoS) via IP SpoofingEPSS 0.8%