CVE-2026-119549

HIGH 7.1CVE-2026-119549 · Published 30/10/2026 · updated 30/10/2026

In short

CVE-2026-119549 is a HIGH (CVSS 7.1) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.

References

abraxaslabs.tech/research/jellyfin-svg-gzip
jellyfin/jellyfin
jellyfin/jellyfin
jellyfin/jellyfin
jellyfin/jellyfin security advisory
vulncheck.com/advisories/jellyfin-through-12.4-ssrf-via-gzip-compressed-data-uri-in-svg-profile-images

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free