CVE-2026-126499 | Jellyfin up to 11.x Virtual Folders jellyfin.db path traversal

November 11, 2026 Yanac

A vulnerability was found in Jellyfin up to 11.x. It has been rated as critical. Impacted is an unknown function of the file jellyfin.db of the component Virtual Folders. Performing a manipulation results in path traversal.

This vulnerability is identified as CVE-2026-126499. The attack can be initiated remotely. There is not any exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More