Jellyfin 10.11.9 → 10.11.11
2 releases · 0 breaking changes · 3 security fixes · 3 advisories fixed
3security0breaking0deprecated1feature2fix
Vulnerabilities fixed by this upgrade
- low CVE-2026-49246 Potential MKV attachment filename path traversal to RCE
- medium CVE-2026-49247 Potential Authenticated path traversal in /ClientLog/Document
- 8.8 CVE-2026-48793 Potential FFmpeg argument injection via unescaped subtitle file path
Breaking changes
None in the release notes.
Security changes
- security Fix GHSA-f47c-m7gr-q92j, by @Shadowghost in 10.11.10
- security Fix GHSA-jg92-mrxq-vv75, by @Shadowghost in 10.11.10
- security Fix GHSA-wwwm-px48-fpvq, by @Shadowghost in 10.11.10
Every release in between
featureAdd lockhelper for UserManager [PR #16944], by @JPVenson
securityFix GHSA-f47c-m7gr-q92j, by @Shadowghost
securityFix GHSA-jg92-mrxq-vv75, by @Shadowghost
securityFix GHSA-wwwm-px48-fpvq, by @Shadowghost
fixFix stale UserData cache [PR #15048], by @theguymadmax
fixFix/user manager collation [PR #16906], by @JPVenson