Description
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
jellyfin jellyfin
Default version status: unaffected
0 to ≤ 12.4affected
pkg:github/jellyfin/jellyfinReferences
- https://github.com/jellyfin/jellyfin/blob/v12.4/src/Jellyfin.Drawing.Skia/SvgSecurityValidator.cs#L169-L173 ↗
- https://github.com/jellyfin/jellyfin/blob/v12.4/Jellyfin.Api/Controllers/ImageController.cs#L96 ↗
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-cf3c-8m59-2vhx ↗
- https://abraxaslabs.tech/research/jellyfin-svg-gzip ↗
- https://github.com/jellyfin/jellyfin ↗
- https://www.vulncheck.com/advisories/jellyfin-through-12.4-ssrf-via-gzip-compressed-data-uri-in-svg-profile-images ↗