Jellyfin up to and including version 12.4 suffers from a server‑side request forgery flaw that allows an authenticated user to upload a profile image containing a Gzip‑compressed SVG encoded as a data URI. Because the SvgSecurityValidator is bypassed, the image is rendered when a client performs an unauthenticated GET /UserImage request. The rendering engine then follows any URLs wrapped inside the SVG, enabling the attacker to cause the Jellyfin server to fetch internal network resources, read local image files, or exhaust server memory. The result is potential disclosure of internal data, local file access, or denial‑of‑service through resource exhaustion.

Jellyfin servers running version 12.4 or earlier are vulnerable. The affected product is the Jellyfin media server, and the specific short CPE identifies all deployments of that product. Affected versions include all releases up to 12.4; no higher version has been confirmed safe in the current advisory.

The CVSS score of 7.1 classifies the issue as high severity. Although the EPSS score is not available, the flaw does not require sophisticated preparation; an attacker simply needs to be an authenticated user on the target server to upload the crafted image, and then an unauthenticated client can trigger the malicious rendering. The vulnerability is not listed in CISA KEV, suggesting that it has not yet been widely exploited in the wild, but the attack can succeed with minimal effort once authentication is obtained.