GHSA-cf3c-8m59-2vhx: Jellyfin through 12.4 SSRF via Gzip-Compressed Data URI in SVG Profile Images
Jellyfin through 12.4 contains a server-side request forgery vulnerability that lets authenticated users bypass SvgSecurityValidator by embedding gzip-compressed SVG in non-SVG image data URIs. Attackers can upload such profile images via POST /UserImage, then trigger unauthenticated rendering via GET /UserImage to fetch internal URLs, read local image files, or exhaust memory.
Event History
Frequently Asked Questions
Who needs to be authenticated to exploit this issue?
An attacker needs an authenticated Jellyfin account to upload the crafted profile image through POST /UserImage. Once uploaded, the image can be rendered through an unauthenticated GET /UserImage request.
What can an attacker do after uploading a malicious profile image?
They can cause the Jellyfin server to make requests to internal URLs, read local image files, or consume server memory. The issue is caused by bypassing SvgSecurityValidator with gzip-compressed SVG embedded in a non-SVG image data URI.
Are unauthenticated users able to upload the malicious image?
The provided information identifies authentication as required for the upload step. It only describes unauthenticated access for triggering rendering after the crafted image has been uploaded.