{"id":"CVE-2026-119549","published":"2026-10-30T12:16:41.330","lastModified":"2026-10-30T19:14:38.697","description":"Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.","cvssScore":7.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://abraxaslabs.tech/research/jellyfin-svg-gzip","tags":[]},{"url":"https://github.com/jellyfin/jellyfin","tags":[]},{"url":"https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/ImageController.cs#L96","tags":[]},{"url":"https://github.com/jellyfin/jellyfin/blob/v12.4/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs#L169-L173","tags":[]},{"url":"https://github.com/jellyfin/jellyfin/security/advisories/GHSA-cf3c-8m59-2vhx","tags":[]},{"url":"https://www.vulncheck.com/advisories/jellyfin-through-12.4-ssrf-via-gzip-compressed-data-uri-in-svg-profile-images","tags":[]}],"exploitRefs":[{"url":"https://github.com/jellyfin/jellyfin","tags":[]},{"url":"https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/ImageController.cs#L96","tags":[]},{"url":"https://github.com/jellyfin/jellyfin/blob/v12.4/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs#L169-L173","tags":[]},{"url":"https://github.com/jellyfin/jellyfin/security/advisories/GHSA-cf3c-8m59-2vhx","tags":[]}],"hasPoc":true,"ai":null}