Is Jellyfin 10.11.2 affected?

CVSS 9.9

8 known vulnerabilities affect 10.11.2 (highest CVSS 9.9).

9 newer releases in its track, up to 10.11.11. What changed up to 10.11.11

Vulnerabilities affecting 10.11.2

9.9
CVE-2026-35031 Potential RCE via subtitle upload path traversal + .strm chain fixed in 10.11.7
8.8
CVE-2026-48793 Potential FFmpeg argument injection via unescaped subtitle file path fixed in 10.11.10
6.5
CVE-2026-35034 Potential Application DoS from excessively large SyncPlay group names fixed in 10.11.7
5.7
CVE-2026-49220 Potential XSS in user management fixed in 10.11.8
low
CVE-2026-49246 Potential MKV attachment filename path traversal to RCE fixed in 10.11.10
medium
CVE-2026-49247 Potential Authenticated path traversal in /ClientLog/Document fixed in 10.11.10
high
CVE-2026-35033 Potential SSRF + Arbitrary file read via stream argument injection fixed in 10.11.7
high
CVE-2026-35032 Potential SSRF + Arbitrary file read via LiveTV M3U tuner fixed in 10.11.7