CVEs / CVE-2021-29490
CVE-2021-29490: jellyfin jellyfin vulnerability
- medium 5.8 CVSS 3.1 (NVD)
- EPSS 71.6% chance of exploitation in the next 30 days, higher than 99% of CVEs (4 Nov 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2021-29490
Description
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image` and `/Images/Remote` via reverse proxy, or limit to known-friendly IPs.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| jellyfin jellyfin | <= 10.7.2 | — |
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 4 Nov 2026.
Severity
| CVSS 3.1 | 5.8 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:NScored by NVD |
|---|---|
| Weakness | CWE-918 |
References
- CVE-2021-29490 on NVD
- CVE-2021-29490 on OSV
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rgjw-4fwc-9v96 Patch, Third Party Advisory
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.