Jellyfin versions prior to 10.11.7 contain a flaw in the subtitle upload endpoint where the Format field is not validated, permitting path traversal through crafted file extensions. This flaw allows an attacker to write arbitrary files on the server, which can then be leveraged to read arbitrary files via .strm chaining, extract database credentials, elevate privileges to an administrator level, and ultimately execute code as the root user through the ld.so.preload mechanism. The compromise results in full compromise of confidentiality, integrity, and availability of the affected system.

The vulnerability affects the Jellyfin media server produced by the jellyfin: jellyfin vendor. Only releases earlier than 10.11.7 are impacted; version 10.11.7 and later contain the fix. The vulnerability is activated when an authenticated user possessing the "Upload Subtitles" permission accesses the POST /Videos/{itemId}/Subtitles endpoint.

The CVSS score of 10 indicates a critical severity. Exploitation requires authenticated access and either an administrator account or a user explicitly given the Upload Subtitles privilege. Public exposure is possible only if such a user account exists, though administrators may log in via the web interface from anywhere. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, but the absence of mitigation does not reduce the inherent risk provided the vulnerable server is accessible.