Improper Neutralization of Argument Delimiters in a Command in Jellyfin - CVE-2026-35033
Published: April 15, 2026
Vulnerability identifier: #VU126126
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-35033
CWE-ID: CWE-88
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper neutralization of argument delimiters in a command in the ParseStreamOptions method in StreamingHelpers.cs and the /Videos/{itemId}/stream endpoint when processing StreamOptions query parameters. A remote attacker can send a specially crafted request to disclose sensitive information.
The issue can be exploited without authentication, and injected ffmpeg arguments can cause server file contents to be rendered into the video stream response.
Affected software
Jellyfin
How to mitigate CVE-2026-35033
Install security update from vendor's website.
Jellyfin - update to 10.11.7