CVE-2021-21402

Katalog CVE

CVSS 6.5 · Medium EPSS 79,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada jellyfin. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.

Rincian

Terbit di NVD

23 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

79,3% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jellyfin/jellyfin/commit/0183ef8e89195f420c48d2600bc0b72f6d3a7fd7 patch · advisory pihak ketiga
• https://github.com/jellyfin/jellyfin/releases/tag/v10.7.1 release notes · advisory pihak ketiga
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wg4c-c9g9-rxhx advisory pihak ketiga