CVE-2023-48702

    Dashboard / Vulnerabilities / CVE-2023-48702

    CVE-2023-48702

    Published: 13 Dec 2023Last Modified: 12 Aug 2026

    Summary: Jellyfin Possible Remote Code Execution via custom FFmpeg binary

    Details: Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the `/System/MediaEncoder/Path` endpoint executes an arbitrary file using `ProcessStartInfo` via the `ValidateVersion` function. A malicious administrator can setup a network share and supply a UNC path to `/System/MediaEncoder/Path` which points to an executable on the network share, causing Jellyfin server to run the executable in the local context. The endpoint was removed in version 10.8.13.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48702.json, https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rr9h-w522-cvmr, https://nvd.nist.gov/vuln/detail/CVE-2023-48702, https://securitylab.github.com/advisories/GHSL-2023-028_jellyfin/, https://github.com/jellyfin/jellyfin/commit/83d2c69516471e2db72d9273c6a04247d0f37c86

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e93d03d8cbff2122d7296f477604146f64758a73

    Affected versions

    v10.8.12
    v10.8.11
    v10.8.10
    v10.8.9
    v10.8.8
    v10.8.7
    v10.8.6
    v10.8.5
    v10.8.4
    v10.8.2
    v10.8.3
    v10.8.1
    v10.8.0
    v10.8.0-beta3
    v10.8.0-beta2
    v10.8.0-beta1
    v10.8.0-alpha5
    v10.8.0-alpha4
    v10.8.0-alpha3
    v10.8.0-alpha2
    v10.8.0-alpha1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-48702 | CVE-DB