Description (CNA)
Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admin(s), there is very little scope for abuse. However, the `DELETE` `files/:filename` can be used to delete any file. This issue has been addressed in version 1.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| CyferShepard / Jellystat | affected < 1.1.3 |
CWE
CWE-22
References
- https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-6x46-6w9f-ffv6
- https://github.com/CyferShepard/Jellystat/pull/303
- https://cwe.mitre.org/data/definitions/22.html
ADP enrichment
No English description supplied.
No references supplied.