Medium severity · published Mar 23, 2021
CVE-2021-21402
Unauthenticated Arbitrary File Access in Jellyfin
6.5
CVSS
79.3%
EPSS
No
On KEV
Description
Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)79.3% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JE
jellyfin · jellyfin
< 10.7.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21402
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21402
Patch
https://github.com/jellyfin/jellyfin/commit/0183ef8e89195f420c48d2600bc0b72f6d3a7fd7
Release Notes
https://github.com/jellyfin/jellyfin/releases/tag/v10.7.1
Third Party Advisory
https://github.com/jellyfin/jellyfin/security/advisories/GHSA-wg4c-c9g9-rxhx
More from jellyfin
9.8
CVE-2026-31852
Jellyfin Possible Organization/Secret Compromise from dangerous CI implementation
9.1
CVE-2026-35033
Jellyfin: Potential SSRF + Arbitrary file read via stream argument injection
8.8
CVE-2026-48793
Jellyfin: Potential FFmpeg argument injection via unescaped subtitle file path
8.8
CVE-2026-49247
Jellyfin: Potential Authenticated path traversal in /ClientLog/Document
8.8
CVE-2026-35031
Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain