Loading story…
Jellyfin disclosed CVE-2026-48793, a high-severity flaw affecting versions earlier than 10.11.10, in which subtitle conversion code passes an unescaped subtitle file path into FFmpeg command-line arguments. On Linux, a specially crafted subtitle filename containing double quotes can break argument quoting and inject arbitrary FFmpeg options through SubtitleEncoder.ConvertTextSubtitleToSrtInternal, exposing a vulnerability class previously seen in related Jellyfin issues.
The vulnerable code path is reachable without authentication through SubtitleController.GetSubtitle, and an attacker who can place a file in a Jellyfin media library directory—such as through a shared NAS, Samba share, or guest upload workflow—could trigger arbitrary file write on the server and information disclosure. The issue carries a CVSS v3.1 score of 8.8, was reported by Alister MacCormack, and has been fixed in Jellyfin 10.11.10; administrators are advised to upgrade and restrict untrusted file placement in media library paths.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-48793 was published as a high-severity Jellyfin vulnerability with a CVSS v3.1 score of 8.8. The CVE describes unauthenticated reachability through SubtitleController.GetSubtitle and notes that attackers able to place files in a media library directory may achieve arbitrary file write and information disclosure.
Jellyfin disclosed a security advisory for a potential FFmpeg argument injection vulnerability affecting versions earlier than 10.11.10 and stated the issue was fixed in version 10.11.10. The flaw involved unescaped subtitle file paths in the subtitle conversion code path and could allow arbitrary FFmpeg argument injection on Linux.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FFmpeg patched **CVE-2026-8461**, a high-severity heap out-of-bounds write flaw dubbed **PixelSmash** in the `libavcodec` **MagicYUV** decoder. The bug is triggered by an odd `slice_height` condition while parsing malicious **AVI**, **MKV**, or **MOV** files and affects FFmpeg versions before **8.1.2**. The vulnerability can cause denial of service and, in some environments, lead to remote code execution. JFrog reported that applications embedding FFmpeg are exposed through their media-processing pipelines, and demonstrated full remote code execution against **Jellyfin 10.11.9** via its automated media library scan workflow, although successful RCE required **ASLR** to be disabled or bypassed. **Nextcloud** was also identified as potentially vulnerable under additional conditions, while **Plex** appears largely protected by a restricted custom FFmpeg build. Organizations using FFmpeg directly or through downstream products have been urged to upgrade to **FFmpeg 8.1.2 or later** and apply vendor patches because the decoder’s broad adoption creates a notable supply-chain exposure.
Jun 29, 2026
A critical, **zero-click unauthenticated OS command injection** vulnerability was disclosed in the open-source video hosting/streaming platform **AVideo**, tracked as **CVE-2026-29058**. The flaw affects versions **prior to 7.0** (including **6.0**) and allows remote attackers to execute arbitrary operating system commands on the server without user interaction or prior privileges, creating a path to **full server compromise**, **data exfiltration** (e.g., configuration secrets, internal keys, credentials), and **service disruption**. The issue stems from `objects/getImage.php`, where attacker-controlled input in the `base64Url` GET parameter is Base64-decoded and incorporated into a double-quoted `ffmpeg` shell command without proper escaping/neutralization of shell metacharacters and command substitution (CWE-78). The vulnerability was reported by security researcher **Arkmarta**, and remediation is available by upgrading to **AVideo 7.0 or later**, which includes the official patch.
Jun 29, 2026
Streambert fixed a critical arbitrary file write flaw in version **2.5.0** after maintainers disclosed multiple security issues, including **GHSA-3q2x-3q9p-qwfc**. The vulnerability affects **Streambert 2.4.0 and earlier**, where subtitle extraction in `src/ipc/subtitles.js` concatenates ZIP entry names into a temporary path without sanitization, allowing path traversal during archive extraction. The issue was reported by **jeremyHOT** and fixed with the 2.5.0 release. The flaw, tracked as **CVE-2026-48055**, allows a malicious subtitle ZIP archive delivered through Streambert’s subtitle download workflow to escape the intended temporary directory and write files anywhere permitted by the application’s privileges. The advisory links exploitation to the `get-subtitle-url` IPC channel and recommends sanitizing extracted filenames, while public vulnerability records rate the bug **CVSS 10.0** and describe it as remotely exploitable. Users are advised to upgrade to **Streambert 2.5.0** immediately.
Jun 29, 2026