2.8 KiB
jellyfin — triage (pin jellyfin/jellyfin:10.11.11)
Template: setup_gate: true (closed to strangers until the startup wizard is done; probe StartupWizardCompleted).
Notices (all 6 REAL by range — 10.11.11 is the last 10.x, released 2026-06-06; no 10.11.12 exists)
| GHSA | sev | login | reachable on a box |
|---|---|---|---|
| 6828-c7cx-hvqm VirtualFolders path traversal → delete/move any dir | critical | none BEFORE wizard, admin after | before wizard: blocked by setup_gate; after: admin only (admin can already delete libraries) → low |
| cf3c-8m59-2vhx SVG external refs → memory DoS + SSRF/local file read | high | any user (POST /UserImage) | yes, any household account |
| hw73-62vp-9gxf HLS legacy segment path traversal, arbitrary file read | medium (AC:H, C:H) | NONE (legacy segment routes not [Authorize]) | YES — strangers, public subdomain |
| 4vx8-xhc9-qg6x session remote-control broken access control (range <=12.0-RC5) | medium | any user | yes, household accounts |
| 9x85-gx46-6522 playlist IDOR | medium | any user | yes, household accounts |
| c39p-cgf8-866g plugin manifest ImagePath traversal | low | needs a malicious plugin (admin installs) | low |
Fix
Smallest fix: 12.0 (all six). TARGET jellyfin/jellyfin:12.4 (Docker Hub tag exists; build tag 12.4.20261026-211555; jellyfin 12 uses
two-part versions). Same main: NO (10 → 12).
Breaking (read v12.0 notes; 12.1–12.4 not needed for the verdict): DB changes with no rollback without full restore; repository plugins must be
removed before migrating; a FULL LIBRARY SCAN is required after upgrade (auto-resolved alternate versions removed); legacy /emby and
/mediabrowser routes removed; legacy authorization disabled by migration; global subtitle config removed; usernames differing only by case must
be fixed before upgrade; obsolete API routes removed.
Lane: BIG_STEP (12.4). Inside main 10: no fixed release (NO_FIX in the quick lane).
Until the big step (what blocks it today / options)
Blocks today: setup_gate covers the critical's anonymous window. Nothing blocks hw73 (stranger file read) or the any-user ones.
- Option A: traefik rule refusing the legacy HLS segment paths (GetHlsAudioSegmentLegacy / GetHlsVideoSegmentLegacy / GetHlsPlaylistLegacy — exact route strings to be read from HlsSegmentController.cs at v10.11.11 before writing the rule; not guessed here) — cost: one template label + a live playback test (modern clients use the non-legacy HLS routes; unsure which clients still use legacy).
- Option B: schedule the 12.4 big step now — cost: tested migration on the bench, full library rescan on every box, plugin removal.
- If you do nothing: a stranger who can reach the subdomain may read files the jellyfin process can read (AC:H), and any household account can exhaust memory / SSRF via an SVG avatar. Classifier note: none.