Jellyfin

Other · products/jellyfin.yaml · RSS

Latest 10.11.11 Jun 6, 2026

Recent releases

10.11.11 Jun 6, 2026 Release notes ↗ 1feature

10.11.10 May 24, 2026 → 10.11.11 Release notes ↗ 3security2fix

securityFix GHSA-f47c-m7gr-q92j, by @Shadowghost

securityFix GHSA-jg92-mrxq-vv75, by @Shadowghost

securityFix GHSA-wwwm-px48-fpvq, by @Shadowghost

10.11.9 May 21, 2026 → 10.11.11 Release notes ↗ 2fix1feature

10.11.8 Apr 5, 2026 → 10.11.11 Release notes ↗ 1security2fix

securityFixes CVE-2026-49220: Potential XSS in user management

10.11.7 Mar 31, 2026 → 10.11.11 Release notes ↗ 4security17fix1breaking

securityFix for GHSA-j2hf-x4q5-47j3, by @Shadowghost

securityFix for GHSA-8fw7-f233-ffr8, by @Shadowghost

securityFix for GHSA-v2jv-54xj-h76w, by @Shadowghost

10.11.6 Jan 19, 2026 → 10.11.11 Release notes ↗ 9fix2feature

10.11.5 Dec 15, 2025 → 10.11.11 Release notes ↗ 14fix

10.11.4 Dec 1, 2025 → 10.11.11 Release notes ↗ 4fix1feature

10.11.3 Nov 16, 2025 → 10.11.11 Release notes ↗ 15fix2feature1breaking

breakingRemove InheritedTags and update tag filtering logic [PR #15493], by @theguymadmax

10.11.2 Nov 3, 2025 → 10.11.11 Release notes ↗ 1security2fix

securityUpdate password reset to always return the same response structure [PR #15254], by @thornbill

10.11.1 Oct 27, 2025 → 10.11.11 Release notes ↗ 5fix1feature

10.11.0 Oct 20, 2025 → 10.11.11 Release notes ↗ 29feature9breaking2deprecated

breakingRemove chapters on file change [PR #14984], by @Shadowghost

breakingRemove appsettings.json loading component from startup server [PR #14275], by @JPVenson

breakingRemove 10.11.z EFcore migration warnings [PR #13972], by @ferferga

10.10.7 Apr 5, 2025 → 10.11.11 Release notes ↗ 2security4fix1breaking

securityFix validation of API parameters to FFmpeg [GHSA-2c3c-r7gp-q32m], by @Shadowghost

securityFix trusting forward headers if none are configured [GHSA-qcmf-gmhm-rfv9], by @JPVenson

breakingRemove empty ParentIndexNumber workaround [PR #13611], by @Shadowghost

10.10.6 Feb 16, 2025 → 10.11.11 Release notes ↗ 8fix1feature

10.10.5 Jan 25, 2025 → 10.11.11 Release notes ↗ 1feature4fix

Security advisories

5.9 GHSA-hw73-62vp-9gxf Potential path transversal exposure in HlsSegmentController.cs

3.1 GHSA-c39p-cgf8-866g Potential path transversal exposure in PluginsController.cs

4.3 GHSA-9x85-gx46-6522 Potential IDOR in playlist management

5.4 GHSA-4vx8-xhc9-qg6x Broken access control in session remote-control API

9.1 GHSA-6828-c7cx-hvqm Path traversal in the virtual-folder management endpoints allows deletion and relocation of arbitrary directories

8.1 GHSA-cf3c-8m59-2vhx Memory exhaustion and SSRF via external references in user-supplied SVG images

5.7 CVE-2026-49220 Potential XSS in user management

low CVE-2026-49246 Potential MKV attachment filename path traversal to RCE

medium CVE-2026-49247 Potential Authenticated path traversal in /ClientLog/Document

8.8 CVE-2026-48793 Potential FFmpeg argument injection via unescaped subtitle file path

high CVE-2026-35033 Potential SSRF + Arbitrary file read via stream argument injection

6.5 CVE-2026-35034 Potential Application DoS from excessively large SyncPlay group names

high CVE-2026-35032 Potential SSRF + Arbitrary file read via LiveTV M3U tuner

9.9 CVE-2026-35031 Potential RCE via subtitle upload path traversal + .strm chain

low GHSA-rrr6-mvwg-9pg9 Resource Exhaustion DoS via Branding Endpoint

medium CVE-2025-32012 IP Spoofing leading to potential DoS

high CVE-2025-31499 FFmpeg Argument Injection

medium CVE-2024-43801 Privilege escalation to admin from a low-privileged user via SVG upload

medium CVE-2023-48702 Possible Remote Code Execution via custom FFmpeg binary

high CVE-2023-49096 Argument Injection in FFmpeg codec parameters

Recent releases

Security advisories

Sources