Advisory · CVE-2026-126499
Jellyfin path traversal can wipe a fresh server before setup finishes
Jellyfin before 12.0 lets an unauthenticated attacker delete or move arbitrary directories through the virtual-folder endpoints while the setup wizard is still open.
- Vendor
- Jellyfin
- Product
- Jellyfin
- Identifier / CWE
- CVE-2026-126499
CWE-22 - Action timing
- Immediate
Explain it like I’m five
Before a new Jellyfin server finishes its first-time setup, anyone on the network can use it without logging in. The library endpoints glue a folder name onto a path without checking it, so an attacker can hand it a name that climbs out of the library and deletes the server's own data.
- 01Fresh server
A newly installed Jellyfin server has not completed the startup wizard, so anonymous access is granted to the virtual-folder endpoints.
- 02Traversal name
An unauthenticated attacker sends a library name such as dot-dot or an absolute path to the delete or rename endpoints.
- 03Path escapes the library
The name is concatenated onto the library root without validation, so the resulting path points outside the library, at any directory the server can write.
- 04Data destroyed
Jellyfin recursively deletes or moves that directory, including the data directory and jellyfin.db, causing permanent data loss.
What happened
Jellyfin before 12.0 contains a path traversal vulnerability in the virtual-folder management endpoints. DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name concatenate the caller-supplied library name onto the user-views root without validation, then pass the result to a recursive directory delete or a directory move. Because the path join accepts a rooted second argument, a name such as dot-dot or an absolute path escapes the library root entirely.
Before the startup wizard is completed, the FirstTimeSetupOrElevated policy grants anonymous access, so a freshly installed server reachable on the network can be destroyed without credentials. After setup, the endpoints require an administrator, who can already delete libraries, so that variant is hardening only. Fixed in Jellyfin 12.0.
What to do
- Upgrade to Jellyfin 12.0 or later.
- Complete the setup wizard immediately after installation, and keep a new server off untrusted networks until then.
- Block /Library/VirtualFolders at a reverse proxy until setup is complete.
- Run the server as an unprivileged account limited to its own data and media directories.
- Keep backups of the data directory so a traversal cannot turn into permanent loss.
Management note
The exposure window here is the gap between install and setup, which is exactly when a new server is most likely to be sitting on an open network with default settings. Treat a fresh install as exposed until the wizard is done.