CVE-2026-35033 is a critical file read in Jellyfin, the self hosted media server. NVD scores it 9.1. A query parameter reaches the ffmpeg command line without validation. Upgrade to Jellyfin 10.11.7 or later. Take the server off the open internet if you cannot patch today.
What's affected
Jellyfin before 10.11.7. The fixed release is 10.11.7.
The advisory notes the streaming endpoint has no authorization attribute. Item identifiers are random, so an attacker needs a valid one, which an authenticated user can obtain. Instances that let other people sign in are a concern.
How to check if you're exposed
Open the Jellyfin dashboard to see the server version, or check the container tag:
docker ps | grep -i jellyfin
If the server is reachable from the internet through a reverse proxy, treat it as a priority. Check your proxy logs for unusual query strings on the video stream path.
What to do now
- Upgrade to Jellyfin 10.11.7 or later.
- If you cannot upgrade yet, take the server off the public internet or put it behind a VPN or authenticating proxy.
- Review which accounts exist and remove ones you do not recognize.
- Run Jellyfin as a low privileged user in a container with no unnecessary mounts, so a file read exposes less.
- Treat secrets on the host as potentially exposed if the server was open to the internet before the update.
Why it matters
The weaknesses are CWE-862 (missing authorization) and CWE-88 (argument injection). The record says a lowercase query parameter is accepted into a dictionary without validation and its value is joined into the ffmpeg command line. Because ffmpeg has filters that can read files, that turns into a way to read server files and return them in the stream.
Two mistakes combine: an endpoint without an authorization check, and a command line built from request data. Passing arguments as separate list items and checking them against an allowlist removes the second.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Media servers are often exposed so family or friends can stream, which makes them a target. If yours is, put it behind a VPN or an authenticating proxy, patch, and check the host for anything it could read that should stay private, such as environment files and keys. Running it as a dedicated low privilege user limits what a file read can reach.
Try it yourself
Watching for new advisories against software you run is a routine job. This demo shows how it can be set up.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be signed in to exploit it?
The endpoint has no Authorize attribute, but the advisory says item GUIDs are pseudorandom and a signed in user can get one. Patch either way.
Sources
Last reviewed: 19 October 2026.
