ENISA's EUVD lists Jellyfin server-side request forgery via SVG image uploads (EUVD-2026-113814)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Jellyfin
- Product
- Jellyfin
- First seen
Summary
The EUVD entry EUVD-2026-113814 reports a server-side request forgery vulnerability in Jellyfin through 12.4, scored 7.1/10 (CVSS v3.1). According to the entry, authenticated users can bypass the SVG security validator by embedding gzip-compressed SVG in non-SVG image data URIs during profile image uploads.
If you use Jellyfin
Upgrade Jellyfin to a release later than 12.4 once the fix is published.
Limit account creation and profile image upload permissions to trusted users.
Monitor server logs for unexpected outbound requests from the Jellyfin host.
Review which playlists are public or shared on your server.
Review parental-control settings for restricted accounts.
Check whether restricted or parental-controlled accounts exist on your server.
What the sources say 3
· Mastodon: “Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter.” Source
· Mastodon: “Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists.” Source
· Mastodon: “Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs.” Source