Is Jellyfin 10.10.6 affected?

CVSS 9.9

11 known vulnerabilities affect 10.10.6 (highest CVSS 9.9).

13 newer releases in its track, up to 10.11.11. What changed up to 10.11.11

Vulnerabilities affecting 10.10.6

9.9
CVE-2026-35031 Potential RCE via subtitle upload path traversal + .strm chain fixed in 10.11.7
8.8
CVE-2026-48793 Potential FFmpeg argument injection via unescaped subtitle file path fixed in 10.11.10
6.5
CVE-2026-35034 Potential Application DoS from excessively large SyncPlay group names fixed in 10.11.7
5.7
CVE-2026-49220 Potential XSS in user management fixed in 10.11.8
low
CVE-2026-49246 Potential MKV attachment filename path traversal to RCE fixed in 10.11.10
medium
CVE-2026-49247 Potential Authenticated path traversal in /ClientLog/Document fixed in 10.11.10
high
CVE-2026-35033 Potential SSRF + Arbitrary file read via stream argument injection fixed in 10.11.7
high
CVE-2026-35032 Potential SSRF + Arbitrary file read via LiveTV M3U tuner fixed in 10.11.7
low
GHSA-rrr6-mvwg-9pg9 Resource Exhaustion DoS via Branding Endpoint
medium
CVE-2025-32012 IP Spoofing leading to potential DoS
high
CVE-2025-31499 FFmpeg Argument Injection