Jellyfin: Path traversal in library virtual folder endpoints
Summary
Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints, because library names are not validated. Before the initial setup is completed, unauthenticated attackers can supply names such as '..' or absolute paths to recursively delete the data directory and jellyfin.db, or to move directories. The main impact is loss of data and integrity and a denial of service.
Affected
- Jellyfin versions before 12.0 (CVE record: affected 0 to < 12.0)
Fixed in
- Jellyfin 12.0 or later
- Unknown whether a 10.11.x release contains the fix.
Workaround
- Complete the initial setup wizard immediately after installation.
- Do not expose the server to the internet until setup is finished and version 12.0 or later is running.
- Back up the data directory before any upgrade.
Exploitation
Unknown. No public proof of concept or confirmed in-the-wild exploitation was found at the time of writing.
Our recommendation
- Check whether any Jellyfin instance is reachable from the internet, especially fresh or unfinished installations.
- Upgrade to Jellyfin 12.0 or later, preferably the latest stable release.
- Back up the data directory before upgrading, because database changes in 12.0 may prevent a simple rollback.
- Monitor the server for unexpected deletion or changes to library folders and the database.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record: Jellyfin GitHub advisory GHSA-6828-c7cx-hvqm github.com
- Jellyfin 12.0 release github.com
- VulnCheck advisory: Jellyfin before 12.0 path traversal www.vulncheck.com
- Jellyfin fix commit 0c560b22 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 02:23.
Original description (NVD)
Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can supply names like .. or absolute paths before setup completes to recursively delete the data directory and jellyfin.db.
NVD references (6)
- https://github.com/jellyfin/jellyfin/blob/v10.11.11/Emby.Server.Implementations/Library/LibraryManager.cs#L32…
- https://github.com/jellyfin/jellyfin/blob/v10.11.11/Jellyfin.Api/Controllers/LibraryStructureController.cs#L1…
- https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e
- https://github.com/jellyfin/jellyfin/releases/tag/v12.0
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-6828-c7cx-hvqm
- https://www.vulncheck.com/advisories/jellyfin-before-12.0-path-traversal-via-library-virtualfolders-endpoints
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.