CVSS 3.1 Score 7.2 of 10 (high)


Published Dec 13, 2023
Updated: Dec 18, 2023


CVE-2023-48702 is a vulnerability found in Jellyfin, a media management and streaming system. It affects versions prior to 10.8.13. The vulnerability allows a malicious administrator to set up a network share and provide a UNC path to the /System/MediaEncoder/Path endpoint, which can execute an arbitrary file in the local context of the Jellyfin server using ProcessStartInfo and the ValidateVersion function. The danger posed by this vulnerability is high, as it could allow an attacker to run malicious executables on the server. To remediate this vulnerability, users should update their Jellyfin installations to version 10.8.13 or newer, as the vulnerable endpoint has been removed in this version.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-48702 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options