CVE-2026-119549: 
Wolfi vulnerability analysis and mitigation

CVE-2026-119549 is a Server-Side Request Forgery (SSRF) vulnerability in Jellyfin through version 12.4 that allows authenticated users to bypass the SvgSecurityValidator by embedding gzip-compressed SVG content within non-SVG image data URIs. An attacker uploads a malicious profile image via POST /UserImage, which can then be triggered by unauthenticated users via GET /UserImage to fetch internal URLs, read local image files, or exhaust server memory. The vulnerability was published on October 30, 2026, with a patch available in versions newer than 12.4. It carries a CVSS v3.1 base score of 7.1 (High) and a CVSS v4.0 base score of 7.1 (High) (Github Advisory, Jellyfin Advisory).

The root cause is CWE-918 (Server-Side Request Forgery), stemming from a logic flaw in SvgSecurityValidator.cs (lines 169–173). The validator checks the MIME type declared in a data URI header to determine whether to recursively validate SVG content — but it only triggers SVG validation when the media type is explicitly image/svg+xml. An attacker can embed a gzip-compressed SVG payload inside a data URI declared as a non-SVG type (e.g., image/png); the validator skips SVG inspection, but the underlying Svg.Skia renderer (SkiaEncoder.GetBitmapFromSvg) still detects and processes the gzip magic bytes (0x1F 0x8B), decompressing and rendering the embedded SVG with library defaults that resolve external references. This allows http://, https://, and file:// URIs embedded in the SVG to be fetched server-side during rasterization. The attack requires only low-privilege authenticated access to upload the image, while triggering rendering is unauthenticated (SvgSecurityValidator source, ImageController source, Jellyfin Advisory).

Exploitation has two primary consequences: denial of service via memory exhaustion, and SSRF with local file disclosure. For DoS, referencing an unbounded resource (e.g., file:///dev/urandom) causes the server to read it into memory without a size cap — testing showed a 16×16 SVG producing a 4.1 GiB peak working set against an 8 GiB limit, with memory retained after load; because the stored SVG is re-rasterized on each image request, a single upload provides a repeatable trigger. For SSRF/file disclosure, http:// and https:// references are fetched by the server and rendered into the output image format, enabling exfiltration of responses that decode as images; file:// references similarly expose local files. The attack surface is widened by the fact that rendering can be triggered without authentication, meaning any internet-facing Jellyfin instance is at risk once a malicious image is uploaded (Jellyfin Advisory, Github Advisory).

As of the disclosure date (October 30, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. NVD SSVC assessment rates exploitation as "none" and the attack as non-automatable due to the requirement for an authenticated upload step. A patch is available in Jellyfin versions newer than 12.4 (Github Advisory, Feedly).

1. Obtain authenticated access: Register or log in to the target Jellyfin instance (version ≤ 12.4) with any standard user account — low-privilege access is sufficient.
2. Craft the malicious payload: Create a valid SVG document containing an external reference (e.g., <image href="http://internal-host/secret"/> for SSRF, <image href="file:///etc/passwd"/> for local file read, or <image href="file:///dev/urandom"/> for DoS). Gzip-compress the SVG to produce a .svgz-style byte stream (magic bytes 0x1F 0x8B).
3. Embed in a non-SVG data URI: Wrap the gzip-compressed SVG as a base64-encoded data URI with a non-SVG MIME type (e.g., data:image/png;base64,<base64-of-gzip-svg>). This causes SvgSecurityValidator to skip SVG content inspection.
4. Upload as profile image: Send a POST /UserImage request with the crafted data URI as the image body and an appropriate Content-Type header (e.g., image/png). The server saves the file without detecting the embedded SVG.
5. Trigger unauthenticated rendering: Send an unauthenticated GET /UserImage?userId=<target-user-id> request. The server rasterizes the stored image via Svg.Skia, which detects the gzip magic bytes, decompresses the SVG, and resolves the embedded external reference server-side.
6. Collect results: For SSRF/file disclosure, download the rendered image response — if the fetched resource decodes as an image, its content is embedded in the output. For DoS, repeat the GET request to continuously exhaust server memory without re-uploading (Jellyfin Advisory, SvgSecurityValidator source).

• Network: Outbound HTTP/HTTPS requests from the Jellyfin server process to internal IP ranges or unexpected external hosts, particularly during image rendering operations; outbound connections to file:// paths (observable via process-level syscall monitoring).
• Logs: Jellyfin API access logs showing POST /UserImage requests with Content-Type: image/png (or other non-SVG types) followed by repeated GET /UserImage requests, especially from different or unauthenticated clients; unusual rendering latency or timeout errors in server logs.
• File System: Profile image files stored in the user configuration directory (e.g., <UserConfigDir>/<username>/profile.png) that contain gzip magic bytes (1F 8B) rather than expected PNG/JPEG headers — detectable via file signature scanning.
• Process/Memory: Sustained or rapidly growing memory consumption by the Jellyfin server process (jellyfin, dotnet) without a corresponding increase in active media streams; out-of-memory events or process restarts correlated with image GET requests.

Upgrade Jellyfin to a version newer than 12.4, which contains a fix for this vulnerability. As a network-level workaround, restrict outbound connections from the Jellyfin server to prevent it from reaching internal infrastructure or arbitrary external URLs. Additionally, implement strict input validation on image uploads to reject files whose binary content begins with gzip magic bytes (0x1F 0x8B) regardless of the declared MIME type. Monitor for unusual memory consumption and suspicious image upload patterns as interim detection measures (Github Advisory, Jellyfin Advisory).

The vulnerability was reported by researcher KarahanGuner and disclosed via the Jellyfin project's GitHub Security Advisories. A related advisory (GHSA-cf3c-8m59-2vhx) was published by Jellyfin maintainer crobibero on September 22, 2026, covering the broader SVG external reference issue (memory exhaustion and SSRF) in versions before 12.0, which was patched in 12.0. CVE-2026-119549 specifically covers the bypass of the validator introduced in 12.0 via gzip-compressed data URIs, affecting through 12.4. A technical write-up was published by Abraxas Labs at abraxaslabs.tech/research/jellyfin-svg-gzip, and VulnCheck issued an advisory covering the same issue (Jellyfin Advisory, Github Advisory).