Summary
CVE-2026-35031 is a vulnerability chain in Jellyfin subtitle upload allowing path traversal to remote code execution (RCE). Patch to 10.11.7.
Affected Asset
Jellyfin media server
Affected Endpoint
Subtitle upload endpoint (web/API upload handler)
Prerequisites
Jellyfin version < 10.11.7; attacker can upload subtitles (authenticated or misconfigured public endpoint).
Steps to Reproduce
Upload subtitle file with embedded path-traversal path (e.g., ../); file writes outside intended directory; achieve RCE via overwritten config/execution path.
Evidence
CVE-2026-35031 advisory; vendor patch notes for 10.11.7; proof-of-concept via subtitle upload payload.
Impact
Remote code execution; full server compromise; access to media library and credentials; potential data exfiltration.
Root Cause
Insufficient path validation on subtitle file storage allows directory traversal from upload directory to server execution paths.
Remediation
Upgrade to Jellyfin 10.11.7+; restrict subtitle upload permissions; sanitize input paths; run Jellyfin in isolated container.
Verification Steps
Confirm version >= 10.11.7 via Settings > About; attempt malicious upload and confirm blocked.