CVE-2026-119549
Received Received - Intake

Jellyfin SSRF via Gzip-Compressed SVG in Profile Images

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119549
EUVD
EUVD-2026-113814

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jellyfin jellyfin 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Jellyfin through version 12.4 allows authenticated users to bypass security checks by embedding gzip-compressed SVG content within non-SVG image data URIs. Attackers can upload malicious profile images via POST /UserImage and trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local files, or cause memory exhaustion.

Detection Guidance

Check Jellyfin logs for unusual SVG image processing requests or memory exhaustion errors. Monitor network traffic for unexpected outbound connections from the Jellyfin server. Inspect uploaded user images for SVG files with gzip-compressed content or external references.

Impact Analysis

An attacker could exploit this to read sensitive local files, access internal network resources, or exhaust server memory by repeatedly triggering large file reads. This could lead to denial of service, data leakage, or unauthorized access to internal systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations may face compliance breaches, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Jellyfin to version 12.0 or later to apply the patch. Disable SVG uploads if not required. Implement strict input validation for all uploaded images. Monitor server memory usage for signs of exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119549. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart