Jellyfin 10.11.10+ Security: Treat Media as Untrusted Input
Tech GuruSecurity and lawful-use boundary: Do not play, upload, redistribute, or build proof-of-concept exploit media. Work only on systems and files you are authorized to inspect. If compromise, regulated data, employee monitoring, notification duties, or legal evidence handling may apply, preserve the original state and involve qualified incident-response and legal personnel before destructive cleanup.
Quick Answer
Jellyfin releases before 10.11.10 are affected by the two June 2026 subtitle and Matroska (MKV) advisories. Stop new untrusted imports, avoid playing suspect files, preserve logs and filesystem evidence, and upgrade to the current stable release, 10.11.11 as checked August 24, 2026. Then make media mounts read-only where practical and retest subtitles, Direct Play, transcoding, identity, clients, and recovery. Patching closes documented paths; it does not prove the host was never compromised.
Evidence status: This scheduled owner remains documentation-backed. The primary advisories, release page, security policy, backup procedure, and container guidance were rechecked on August 24, 2026. The commands and example outputs below have not been performed by TechGeeks, and no screenshot, malformed-file test, upgrade, rollback, or compromise-eradication result is claimed.
What the June 2026 Advisories Establish
| Advisory | Affected | Fixed | Documented condition and impact |
|---|---|---|---|
| GHSA-wwwm-px48-fpvq / CVE-2026-48793 | Earlier than 10.11.10 | 10.11.10 | High-severity FFmpeg argument injection through an unescaped subtitle file path. An attacker able to place a crafted filename in a library path could reach arbitrary file write and information disclosure. |
| GHSA-f47c-m7gr-q92j / CVE-2026-49246 | Earlier than 10.11.10 | 10.11.10 | Low-severity MKV attachment filename path traversal. A forged attachment filename can redirect subtitle extraction outside the intended attachment path during affected playback behavior. |
The fixed floor is 10.11.10, but Jellyfin's security policy guarantees security patches only for the most recent stable server release. On August 24, 2026, that release was 10.11.11. Jellyfin 12.0 release candidates were prereleases; do not turn an urgent patch into an unplanned major-version preview migration.
The first advisory is reachable through an unauthenticated subtitle endpoint, but its documented impact still depends on an attacker being able to place a file in a Jellyfin library directory, such as through an overly broad network share or guest upload workflow. The second depends on crafted MKV attachment metadata and playback that extracts or burns subtitles. These conditions make ingest and filesystem permissions part of the response, not an excuse to delay patching.
Interactive Operating Model
The preserved model moves from containment to evidence, remediation, and validation. Each card names an output that belongs in the change or incident record before the next stage begins.
Go, Hold, Recover, or Escalate
| Decision | Required evidence | Action |
|---|---|---|
| Proceed with patch canary | Version and image known, consistent backup available, management retained, no active compromise indication | Patch the least-critical representative target and run acceptance tests |
| Hold and inventory | Version, writable path, ingest owner, plugin, identity, or backup is unknown | Resolve the unknown without playing suspect media |
| Recover clean | Unexpected writes, integrity failure, unauthorized access, unexplained process, token exposure, or lost trust | Keep isolated; rebuild from known-good software and reviewed data |
| Escalate | Evidence, regulated data, notification, insurance, employment, or legal duties may apply | Preserve evidence and engage qualified responders or counsel |
Step 1: Contain Without Destroying Evidence
- Start a UTC incident/change timeline. Record the decision maker, server, access path, current symptom, and each containment action.
- Pause Sonarr, Radarr, download clients, watched folders, guest uploads, and other writers that can place files in Jellyfin libraries. Preserve their logs.
- Do not play, scan, rename, extract, or probe a suspect subtitle or MKV merely to see what happens.
- Remove direct Internet exposure and restrict remote access to a known private management path. Preserve local console or out-of-band access.
- Do not delete files, prune containers, clear logs, run a full library rescan, or rotate every secret before determining whether evidence obligations apply.
If Jellyfin is earlier than 10.11.10 and no compromise is suspected, the operational goal is a prompt controlled patch, not extended exposure while building a perfect test environment. If compromise is suspected, availability and eradication become separate workstreams.
Step 2: Inventory Version, Image, Mounts, and Writers
Run from the Compose directory and store the unredacted output in private evidence. These examples use a Compose service named jellyfin, derive its actual container ID, and have not been run by TechGeeks.
cd /srv/media-stack
date -u +%FT%TZ
docker compose config --quiet
docker compose ps jellyfin
curl -fsS http://127.0.0.1:8096/System/Info/Public \
| jq '{ProductName,Version,OperatingSystem}'
CONTAINER_ID=$(docker compose ps -q jellyfin)
test -n "$CONTAINER_ID"
docker inspect --format '{{.Config.Image}} {{.Image}}' "$CONTAINER_ID"
docker inspect --format '{{range .Mounts}}{{println .Source "->" .Destination "RW=" .RW}}{{end}}' "$CONTAINER_ID"
IMAGE_ID=$(docker inspect --format '{{.Image}}' "$CONTAINER_ID")
docker image inspect "$IMAGE_ID" --format '{{json .RepoDigests}}' | jq .Example expected output (not observed):
2026-08-24T20:00:00Z
jellyfin jellyfin/jellyfin:10.11.9 Up
{"ProductName":"Jellyfin Server","Version":"10.11.9","OperatingSystem":"Linux"}
jellyfin/jellyfin:10.11.9 sha256:<LOCAL_IMAGE_ID>
/srv/jellyfin/config -> /config RW= true
/srv/media/movies -> /media/movies RW= false
[
"jellyfin/jellyfin@sha256:<REGISTRY_DIGEST>"
]The vulnerable version in that output is illustrative, not an observed TechGeeks host. Record plugins, LDAP/authentication provider, reverse proxy, request/import applications, transcode and temporary directories, subtitle downloaders, metadata writers, service account, host users/groups, network shares, and any path mounted read-write.
Step 3: Preserve Logs, Writes, and a Recovery Copy
Collect logs before restart because container logs may rotate. Treat file paths and output as private: they can reveal titles, users, addresses, tokens, and incident scope.
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" \
"/srv/incident/jellyfin-$STAMP"
docker compose logs --timestamps --since 168h jellyfin \
>"/srv/incident/jellyfin-$STAMP/container.log" 2>&1
sudo env TZ=UTC find /srv/media -xdev -type f -newermt '2026-06-01T00:00:00Z' \
-printf '%TY-%Tm-%TdT%TH:%TM:%TSZ %s %u:%g %m %p\n' \
>"/srv/incident/jellyfin-$STAMP/media-file-timeline.private.txt"
sudo env TZ=UTC find /srv/jellyfin -xdev -type f -newermt '2026-06-01T00:00:00Z' \
-printf '%TY-%Tm-%TdT%TH:%TM:%TSZ %s %u:%g %m %p\n' \
>"/srv/incident/jellyfin-$STAMP/state-file-timeline.private.txt"
sudo sha256sum /srv/incident/jellyfin-$STAMP/* \
| sudo tee "/srv/incident/jellyfin-$STAMP/SHA256SUMS" >/dev/nullExample expected outcome (not observed): private timestamped log and filesystem-timeline files plus a checksum manifest. The chosen start time must match the local exposure window; a June 1 example is not a universal incident date. Hashes prove later file identity, not safety or provenance.
For recovery, Jellyfin 10.11 offers a built-in online backup under Dashboard > Backups; take it during low activity with no scan running. A manual Docker backup requires stopping Jellyfin before copying the persistent /config source. Preserve the original evidence separately from the working recovery copy. Do not restore a potentially compromised configuration into a trusted environment without review.
Step 4: Patch to the Current Stable Release
Resolve the current official image and platform digest. Do not paste a digest from another architecture, registry, or article. A digest pin makes the deployed bytes explicit, but it also prevents automatic receipt of later security fixes; updating the reviewed digest is part of the patch process.
docker buildx imagetools inspect jellyfin/jellyfin:10.11.11
docker pull jellyfin/jellyfin:10.11.11
docker image inspect jellyfin/jellyfin:10.11.11 \
--format '{{json .RepoDigests}}' | jq .Review and place the correct digest in Compose. This configuration is an unperformed example and must be reconciled with the existing image, UID/GID, GPU devices, network, and paths:
services:
jellyfin:
image: jellyfin/jellyfin@sha256:<REVIEWED_PLATFORM_DIGEST_FOR_10.11.11>
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
volumes:
- /srv/jellyfin/config:/config
- /srv/jellyfin/cache:/cache
- /srv/media/movies:/media/movies:ro
- /srv/media/tv:/media/tv:roTest capability dropping on a canary because GPU, networking, and host integrations differ. Separate ingest applications can retain narrowly scoped write access to staging or final library paths; Jellyfin playback normally does not need broad write access to source media. If local NFO, artwork, subtitle, or deletion workflows require writes, isolate those paths and document the risk instead of mounting all storage read-write.
cd /srv/media-stack
docker compose config --quiet
docker compose pull jellyfin
docker compose up -d --no-deps jellyfin
docker compose ps jellyfin
curl -fsS http://127.0.0.1:8096/System/Info/Public \
| jq '{ProductName,Version,OperatingSystem}'
docker compose logs --since 10m --timestamps jellyfinExample expected output (not observed): the service is running the reviewed digest, the public system endpoint reports 10.11.11, startup reaches a ready state without unexplained migration or plugin errors, and the server remains on the private management path.
Step 5 Validation: Positive, Negative, and Recovery Paths
- Version: API-reported version, container image ID, and registry digest agree with the change record.
- Positive playback: Authorized known-good media Direct Plays on one browser and one household client.
- Subtitle path: Known-good text and image subtitles behave as expected; pair the client outcome with the matching FFmpeg log.
- Controlled transcode: A representative file transcodes without an unexpected output path, argument, or write outside configured cache/transcode locations.
- Identity: Non-admin login, administrator login from a private path, and LDAP/plugin login if used all work as intended.
- Library and scans: A controlled scan completes; ingest remains paused until the acceptance gate passes.
- Denied write: The Jellyfin container cannot create a test file in a read-only media mount.
- Recovery: Restore a reviewed backup on an isolated target at the matching patched version and verify users, libraries, clients, and logs.
- Monitoring: A synthetic login/playback or equivalent path alert reaches a monitored channel independent of the Jellyfin host.
Use a synthetic empty directory inside the actual read-only media mount for the denial. Do not write into real media or use a crafted exploit file.
# Safe isolation check example; not performed by TechGeeks.
docker compose exec -T jellyfin sh -c 'touch /media/movies/.tg-write-test'
printf 'exit=%s\n' "$?"Example expected output (not observed):
touch: cannot touch '/media/movies/.tg-write-test': Read-only file system
exit=1This denial proves only that the tested mount rejected that write from that container. It does not prove that every config, cache, temporary, network-share, plugin, or host path is constrained.
Rollback and Clean Recovery
Do not roll back below 10.11.10 to recover service; that returns to the advisory's affected range. Jellyfin also has no general downgrade mechanism after database migrations. A retained old image is not sufficient: rollback requires the matching pre-migration data and configuration backup.
- If 10.11.11 fails without compromise indicators, keep the service private, preserve new logs, and diagnose image architecture, mounts, permissions, database migration, plugins, GPU, proxy, and client behavior.
- Restore only onto an isolated target using the Jellyfin built-in restore or a stopped manual copy, and run the same patched release unless the official current recovery procedure explicitly requires another fixed version.
- If trust is lost, rebuild the host or container environment from known-good software, inspect data before reintroduction, rotate Jellyfin admin passwords, API keys, LDAP credentials, proxy secrets, and downstream Arr/request tokens from a clean client, and revoke sessions.
- Do not delete the original evidence when the clean rebuild becomes operational.
Troubleshooting by Evidence
| Symptom | First check | Stop condition |
|---|---|---|
| API still reports an older version | Compose image reference, pulled digest, recreated container ID, and proxy cache | Do not reopen access |
| Container starts, UI fails | Startup/migration logs, config ownership, free space, database, and proxy route | Preserve logs before another restart |
| Subtitles fail after patch | Client/version, subtitle type, known-good file, FFmpeg log, and permissions | Do not use suspect media as the test |
| Read-only mount breaks metadata workflow | Which exact feature writes NFO, artwork, subtitles, or deletions | Do not restore broad write access without a scoped design |
| Unexpected file appears outside cache/config | Timestamp, owner, process, path, logs, and ingest writer | Isolate and escalate possible compromise |
| Restore starts but users/libraries differ | Backup origin, server version, same-system boundary, paths, and selected backup components | Do not overwrite the only backup |
Security, Privacy, Legal, and Recovery Boundaries
A fixed release addresses documented code paths; it does not establish that persistence, stolen tokens, altered media, downstream access, or a second vulnerability is absent. Filesystem read-only controls limit one impact path but do not replace patching. Evidence can contain private titles, paths, users, addresses, authentication values, and regulated data. Restrict access, record custody and retention, and publish only reviewed redacted derivatives. Obtain qualified advice for notification, employee monitoring, customer disclosure, insurance, or legal evidence duties.
What the Evidence Does Not Prove
- The advisories do not prove that every pre-10.11.10 host was exploited; they establish affected code and conditions.
- Running 10.11.11 does not prove the host was never compromised or that all current and future Jellyfin vulnerabilities are closed.
- A clean startup and successful stream do not prove plugins, LDAP, reverse proxies, downloaders, network shares, or every client are safe.
- A denied media write does not prove the service account cannot write elsewhere.
- An isolated restore proves only the recorded backup and test target at that time; it does not prove full incident eradication.
- No malformed media, upgrade, rollback, screenshot, or lab result described here has been performed by TechGeeks.
Planned Evidence Checklist
- Planned: Record a canary's server/client versions, official image digest, plugins, mounts, service UID/GID, ingest writers, identity provider, proxy, and authorized test media.
- Planned: Capture pre-change backup, hashes, exact commands/exit codes, startup logs, version response, mount-denial result, and change duration.
- Planned: Test known-good subtitles, Direct Play, transcode, LDAP if present, browser plus TV/mobile clients, controlled scan, alert, and isolated restore.
- Planned: Use only a security-reviewed benign regression fixture if a malformed-input test is later approved; do not create or publish exploit media.
- Planned: Store raw evidence under
artifacts/labs/jellyfin-10-11-10-plus-security-treat-media-as-untrusted-input/YYYY-MM-DD/and complete original-resolution redaction review.
Series Navigation and Related TechGeeks Resources
- Network Security Field Notes: Start Here
- Resilience Planning: Patch, Shield, Replace, or Segment
- 15 Router Security Settings to Audit
- Back Up and Restore Jellyfin and the Media Automation Stack
Publication-Day Rechecks
- Reopen both GitHub security advisories and verify affected and patched versions, severity, conditions, and revisions.
- Reopen Jellyfin releases and security policy. Confirm the current stable release and whether the version-specific H1 remains accurate.
- Reopen container and backup documentation. Reconcile image tags, backup/restore behavior, paths, and downgrade boundaries.
- Recheck every TechGeeks URL and series owner. Block publication if required links are unresolved or ownership changed.
- Record the UTC check, reviewer, and outcome in the source-check report before changing this scheduled post.
References
- Jellyfin advisory GHSA-wwwm-px48-fpvq
- Jellyfin advisory GHSA-f47c-m7gr-q92j
- Jellyfin Server 10.11.11 release
- Jellyfin security policy and advisories
- Jellyfin container installation
- Jellyfin backup and restore
- Jellyfin troubleshooting
- Docker Compose service image and digest syntax
The operational standard is not only “version 10.11.11 is running.” It is a constrained ingest path, explicit writable storage, preserved evidence, a reviewed current image, ordinary-client acceptance, a denied write, a recoverable backup, monitoring, and a decision to rebuild when trust cannot be established.
Need help applying this?
Bring TechGeeks into the real environment.
If you are working through this on a live network, WordPress site, Linux server, AI workflow, or PisoWiFi deployment, send the context and we can help turn it into a practical plan.
