CVE-2023-30626

Published April 24th, 2023

View on NVD ↗

CVSS v3

8.8

HIGH

CVSS v2

N/A

Affected

PROJECTS

Description

Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `ClientLogController`, specifically `/ClientLog/Document`. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this can result in file write and arbitrary code execution. Version 10.8.10 has a patch for this issue. There are no known workarounds.

jellyfin/jellyfin-web

The Free Software Media System - Official Web Client

GitHub

3.62K

jellyfin/jellyfin

The Free Software Media System - Server Backend & API

GitHub

52.9K