CVE-2023-30626

Katalog CVE

CVSS 8.1 · High EPSS 2,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada jellyfin. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the `ClientLogController`, specifically `/ClientLog/Document`. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this can result in file write and arbitrary code execution. Version 10.8.10 has a patch for this issue. There are no known workarounds.

Rincian

Terbit di NVD

24 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 79,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq advisory vendor
• https://github.com/jellyfin/jellyfin/blob/22d880662283980dec994cd7d35fe269613bfce3/Jellyfin.Api/Controllers/Cl... exploit · advisory vendor
• https://github.com/jellyfin/jellyfin/pull/5918 patch · advisory vendor
• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65m exploit · patch · advisory vendor
• https://github.com/jellyfin/jellyfin/commit/82ad2633fdfb1c37a158057c7935f83e1129eda7 patch
• https://github.com/jellyfin/jellyfin/releases/tag/v10.8.10 release notes