CVE-2023-30626: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory traversal vulnerability inside the ClientLogController, specifically /ClientLog/Document. When combined with a cross-site scripting vulnerability (CVE-2023-30627), this can result in file write and arbitrary code execution. Version 10.8.10 has a patch for this issue. There are no known workarounds.
References
- github.com/advisories/GHSA-9p5f-5x8v-x65m
- github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pq
- github.com/jellyfin/jellyfin/blob/22d880662283980dec994cd7d35fe269613bfce3/Jellyfin.Api/Controllers/ClientLogController.cs
- github.com/jellyfin/jellyfin/commit/82ad2633fdfb1c37a158057c7935f83e1129eda7
- github.com/jellyfin/jellyfin/pull/5918
- github.com/jellyfin/jellyfin/releases/tag/v10.8.10
- github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65m
- nvd.nist.gov/vuln/detail/CVE-2023-30626
Code Behaviors & Features
Detect and mitigate CVE-2023-30626 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →