Jellyfin RCE: Critical Flaw Chains Arbitrary File Write to Root

The National Vulnerability Database recently detailed a critical vulnerability, CVE-2026-35031, affecting Jellyfin, the popular open-source self-hosted media server. This nasty chain of flaws, present in versions prior to 10.11.7, starts with improper validation in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles).

According to the National Vulnerability Database, attackers can leverage path traversal via the Format field and an unvalidated file extension to achieve arbitrary file write. This isn’t just a nuisance; it’s the first domino. From there, the attack can escalate to arbitrary file read via .strm files, database extraction, admin privilege escalation, and ultimately, remote code execution (RCE) as root using ld.so.preload. The good news? Exploitation requires either an administrator account or a user explicitly granted ‘Upload Subtitles’ permission. Still, that’s a significant attack surface for a critical vulnerability scoring 9.9 CVSS.