Skip to content
Fencer Vulns
high 7.7

CVE-2021-21402 in the critical feed json

Unauthenticated Arbitrary File Access in Jellyfin

published 2021-03-23 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8698

cvss
7.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
79.3%
EPSS 79.3% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known, plus a Nuclei check

Summary

Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is used as the host OS. Servers that are exposed to the public Internet are potentially at risk. This is fixed in version 10.7.1. As a workaround, users may be able to restrict some access by enforcing strict security permissions on their filesystem, however, it is recommended to update as soon as possible.

Patch / fix

  • jellyfin jellyfin 10.7.1

Exploit prediction

79.31% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

  • jellyfin jellyfin

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.