Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…llyfin/security/advisories/GHSA-cf3c-8m59-2vhx Üretici bülteni
• abraxaslabs.tech/research/jellyfin-svg-gzip Üçüncü taraf
• vulncheck.com/…gzip-compressed-data-uri-in-svg-profile-images Üçüncü taraf
• github.com/…/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs Diğer
• github.com/….4/Jellyfin.Api/Controllers/ImageController.cs Diğer
• github.com/jellyfin/jellyfin Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:31Yayımlandı

İlgili açıklar

• 3,5 CVE-2026-119550Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
• 6,5 CVE-2026-119551Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
• 6,5 CVE-2026-119575ArcadeDB 26.8.1 before 26.10.2 SSRF via ALTER DATABASE LOAD CSV Block List
• 2,7 CVE-2026-101209Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability.
• 5,3 CVE-2026-119545Forgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
• 3,7 CVE-2026-119428phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled