CVE-2026-119549

    Dashboard / Vulnerabilities / CVE-2026-119549

    CVE-2026-119549

    Published: 30 Oct 2026Last Modified: 2 Nov 2026

    Summary: Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images

    Details: Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.

    References: https://abraxaslabs.tech/research/jellyfin-svg-gzip, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119549.json, https://github.com/jellyfin/jellyfin/security/advisories/GHSA-cf3c-8m59-2vhx, https://nvd.nist.gov/vuln/detail/CVE-2026-119549, https://www.vulncheck.com/advisories/jellyfin-through-12.4-ssrf-via-gzip-compressed-data-uri-in-svg-profile-images, https://github.com/jellyfin/jellyfin, https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/ImageController.cs#L96, https://github.com/jellyfin/jellyfin/blob/v12.4/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs#L169-L173

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v12.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119549 | CVE-DB