Executive Summary

This vulnerability exists in Jellyfin, an open source self-hosted media server, in versions prior to 10.11.10. It involves a flaw in how Jellyfin handles MKV files with specially crafted filename tags. The application trusts the MKV file name tag on MKV attachments without sanitizing it and uses it directly in a path combination function (Path.Combine) to determine where to extract attachments.

Because the .NET Path.Combine function does not normalize or reject certain path elements like '..' or rooted paths, an attacker can craft an MKV file with a forged filename tag that redirects the extraction process to any absolute path on the disk. This happens during playback when the client attempts to burn in subtitles by default, potentially allowing unauthorized file access or overwriting.

This vulnerability was fixed in Jellyfin version 10.11.10.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker to manipulate the file extraction path on the server by using a specially crafted MKV file. This could lead to unauthorized access or modification of files on the server's filesystem.

During playback, the client attempts to burn in subtitles by default, triggering the extraction process. If exploited, this could result in overwriting or reading sensitive files outside the intended directory, potentially compromising the server's integrity or confidentiality.

However, the CVSS score is low (1.7), indicating that the impact might be limited or require specific conditions to exploit.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from specially crafted MKV files containing forged filename tags that exploit path traversal during playback in Jellyfin versions prior to 10.11.10.

To detect this vulnerability on your system, you should check for the presence of MKV files with suspicious or unusual filename tags that could contain absolute paths or path traversal sequences.

Since the vulnerability triggers during playback when subtitles are burned in, monitoring Jellyfin logs for errors or unusual file access patterns related to MKV attachments might help identify exploitation attempts.

There are no specific commands provided in the available resources to detect this vulnerability directly.

As a general approach, you can scan your media library for MKV files with suspicious tags using tools that can inspect MKV metadata, such as `mkvinfo` or `ffprobe`, and look for filename tags containing absolute paths or '..' sequences.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Jellyfin to version 10.11.10 or later, where the issue has been fixed.

Useful 0 Not Useful 0