The vulnerability occurs in Jellyfin’s LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts). The tuner URL is not validated, allowing attackers to supply non‑HTTP paths for local file read as well as HTTP URLs that trigger Server‑Side Request Forgery. Because the EnableLiveTvManagement permission defaults to true for new users, any authenticated user can exploit this flaw. The flaw exposes the Jellyfin database, potentially leaking admin session tokens and enabling privilege escalation. The weakness is categorized as CWE‑73 (Unvalidated Path Manipulation) and CWE‑918 (Server‑Side Request Forgery).

Vendors and products affected are Jellyfin. All versions older than 10.11.7 are impacted. The vulnerability has been fixed in version 10.11.7.

The flaw carries a CVSS score of 8.6, indicating a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently actively exploited in the wild. However, the attack vector is relatively simple for an authenticated user, requiring only the ability to add an M3U tuner. An attacker can create a chain by pointing a tuner to an attacker‑controlled server that serves a crafted M3U file with a channel referencing the Jellyfin database, exfiltrate that database, and then leverage extracted admin session tokens to gain administrative privileges. Because the flaw combines SSRF with local file read, the potential impact on confidentiality, integrity, and availability is significant if not mitigated promptly.