Threats tagged 'ghsa-v76m-gqgv-m4g2'

Jellyfin versions prior to 12.0 have a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints. This flaw allows unauthenticated attackers to delete or move directories by supplying crafted library names such as '..' or absolute paths before setup completes. Exploitation can lead to recursive deletion of the data directory and the jellyfin.db database file.