CVE-2026-48793 — Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path

Description (CNA)

Jellyfin is an open source self hosted media server. Prior to 10.11.10, a potential FFmpeg argument injection vulnerability exists in the subtitle conversion code path. SubtitleEncoder.ConvertTextSubtitleToSrtInternal (SubtitleEncoder.cs, line 382) interpolates the subtitle file path into FFmpeg command-line arguments without calling EncodingUtils.NormalizePath(). On Linux, filenames can contain double-quote characters, which break the argument quoting and allow injection of arbitrary FFmpeg arguments. The vulnerability is reachable without authentication via SubtitleController.GetSubtitle, which has no [Authorize] attribute. An attacker who can place a file in a Jellyfin media library directory (shared NAS, Samba share, guest upload) can achieve arbitrary file write on the server and information disclosure. This vulnerability is fixed in 10.11.10.

Affected (CNA)

Vendor / product	Versions
jellyfin / jellyfin	affected < 10.11.10

CWE

CWE-88

References

https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wwwm-px48-fpvq

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.