CVE-2026-35032

HighPublic PoC

Published: 14 April 2026

Published

14 April 2026

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0003 10.4th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-35032 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Jellyfin Jellyfin. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the lack of validation on tuner URLs, preventing local file reads via path traversal and SSRF via arbitrary HTTP requests.

AC-6 Least Privilege good match

prevent

Enforces least privilege by restricting EnableLiveTvManagement permission, preventing exploitation by non-admin authenticated users as recommended in the advisory.

SI-2 Flaw Remediation good match

prevent

Remediates the vulnerability chain by applying the patch to Jellyfin version 10.11.7, eliminating the unvalidated tuner endpoint flaws.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The vulnerability in the public-facing Jellyfin media server (via unauthenticated validation flaws in the LiveTV tuner endpoint) is directly exploited by low-privileged authenticated users to read local database files and extract admin session tokens, enabling privilege escalation to administrator level.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL is not validated, allowing local file read via non-HTTP paths and…

Server-Side Request Forgery (SSRF) via HTTP URLs. This is exploitable by any authenticated user because the EnableLiveTvManagement permission defaults to true for all new users. An attacker can chain these vulnerabilities by adding an M3U tuner pointing to an attacker-controlled server, serving a crafted M3U with a channel pointing to the Jellyfin database, exfiltrating the database to extract admin session tokens, and escalating to admin privileges. This issue has been fixed in version 10.11.7. If users are unable to upgrade immediately, they can disable Live TV Management privileges for all users.

Deeper analysisAI

CVE-2026-35032 is a vulnerability chain affecting Jellyfin, an open-source self-hosted media server, in versions prior to 10.11.7. The issue resides in the LiveTV M3U tuner endpoint (POST /LiveTv/TunerHosts), where the tuner URL lacks proper validation. This enables local file reads through non-HTTP paths and Server-Side Request Forgery (SSRF) via HTTP URLs. The vulnerability is associated with CWE-73 (External Control of File Name or Path) and CWE-918 (SSRF), earning a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

Any authenticated user can exploit this vulnerability, as the EnableLiveTvManagement permission defaults to true for all new users. An attacker chains the flaws by adding an M3U tuner host pointing to a server they control, which serves a crafted M3U playlist containing a channel that targets the Jellyfin database file. This allows exfiltration of the database, from which admin session tokens can be extracted to escalate privileges to administrator level.

The vulnerability has been addressed in Jellyfin version 10.11.7. For users unable to upgrade immediately, the advisory recommends disabling Live TV Management privileges for all users. Additional details are available in the Jellyfin release notes at https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 and the security advisory at https://github.com/jellyfin/jellyfin/security/advisories/GHSA-8fw7-f233-ffr8.