CVE-2026–35031: Critical Path Traversal to RCE in Jellyfin Media Server

📰 Medium · Cybersecurity

Learn about CVE-2026-35031, a critical path traversal to RCE vulnerability in Jellyfin Media Server, and how to detect and remediate it

advanced Published 15 Apr 2026

Action Steps

Identify Jellyfin Media Server versions prior to 10.11.7 that may be vulnerable to CVE-2026-35031
Run detection scripts from Github to identify potential vulnerabilities
Apply the patch for CVE-2026-35031 to remediate the vulnerability
Configure security measures to prevent path traversal attacks
Monitor system logs for suspicious activity related to the vulnerability

Who Needs to Know This

Security teams and developers responsible for maintaining Jellyfin Media Server instances can benefit from understanding this vulnerability to take corrective actions and prevent potential attacks

Key Insight

💡 A missing validation check in the subtitle upload endpoint can lead to database extraction, credential theft, and remote code execution as root