CVE-2026-35031：Jellyfin 字幕上传路径遍历至 RCE

摘要

Jellyfin 媒体服务器中存在一个严重的路径遍历漏洞，允许具有“上传字幕”权限的经过身份验证的用户将文件上传到磁盘上的任意位置。通过利用字幕上传端点中未经验证的 Format 字段，攻击者可以写入敏感位置的文件、窃取敏感数据、提升权限，并最终通过 LD_PRELOAD 注入以 root 身份执行任意代码。

CVSS 评分： 9.9（严重）
受影响版本： Jellyfin < 10.11.7
修复版本： Jellyfin 10.11.7+
所需身份验证： 是（具有字幕上传权限的非管理员用户）
远程代码执行： 是，以 root 身份
利用复杂度： 低

快速事实

什么是 Jellyfin？

Jellyfin 是一款免费开源的媒体服务器，旨在帮助您管理和流式传输个人媒体收藏。它提供与商业媒体服务器类似的功能，但拥有完全透明的源代码和社区控制权。

主要功能

自托管媒体流媒体（音乐、电影、电视节目）
多用户支持，具有细粒度的权限控制
字幕管理与同步
通过 HTTP/HTTPS 访问的基于 Web 的界面
跨平台部署（Linux、Windows、macOS）
支持各种媒体格式和流媒体协议

网络架构```

                      Jellyfin Media Server (Port 8096)
                     /                |                \
                    /                 |                 \
               Web UI            REST API          Media Streams
              (Browser)        (Authenticated)    (Subtitle Upload)
                                     |
                    /System/Info/Public (unauthenticated)
                    /Videos/{itemId}/Subtitles (vulnerable)
                    /Library/Collections (admin)

Client Devices > Network > Jellyfin Server > Database + Storage | /var/lib/jellyfin/ /etc/ld.so.preload (writable via vulnerability)

---

## 漏洞深度剖析

### 根因分析

该漏洞存在于字幕上传端点（`/Videos/{itemId}/Subtitles`）中，该端点接受文件上传并将其存储在磁盘上。关键缺陷在于对 Format 字段参数的验证不足。

#### 易受攻击的代码模式

该端点在处理字幕上传时，未正确验证或清理 Format 字段：```
POST /Videos/{itemId}/Subtitles HTTP/1.1
Content-Type: multipart/form-data

[Binary subtitle data]
Format: /../../../etc/ld.so.preload
Language: en

Format 参数本用于指定字幕格式（srt、vtt、ass 等），但反而会被当作文件路径的一部分：``` Base Path: /var/lib/jellyfin/subtitles/ User Input: /../../../etc/ld.so.preload Result: /var/lib/jellyfin/subtitles/../../../etc/ld.so.preload Resolved: /etc/ld.so.preload (via path traversal)

### 攻击链分解

该漏洞将多个弱点串联在一起，以实现以 root 身份远程执行代码：```
Step 1: Subtitle Upload with Path Traversal
        POST /Videos/{itemId}/Subtitles
        Format: /../../../etc/ld.so.preload
                    |
                    v
Step 2: Arbitrary File Write
        Write attacker-controlled data to /etc/ld.so.preload
                    |
                    v
Step 3: File Read via .strm Files
        Create .strm files pointing to sensitive paths
        Extract database contents and credentials
                    |
                    v
Step 4: Database Extraction
        Access /jellyfin/jellyfin.db via .strm
        Extract admin user hashes
                    |
                    v
Step 5: Admin Privilege Escalation
        Reset admin password or create new admin account
                    |
                    v
Step 6: RCE via LD_PRELOAD Injection
        LD_PRELOAD=/path/to/malicious.so java
        Arbitrary code execution as root

路径遍历机制```

Input Validation Failure:

Format Field Validation: Expected: srt | vtt | ass | ssa | sub | subrip Actual: /../../../etc/ld.so.preload Result: NO VALIDATION > PATH TRAVERSAL ALLOWED

File Write Operation: String Concatenation: "/subtitles/" + user_format + ".srt" | NO CANONICALIZATION: Path component not resolved before write NO WHITELIST: Format values not restricted NO BOUNDS CHECK: ".." sequences not filtered | v Final Path: /etc/ld.so.preload (EXPLOITED)

### LD_PRELOAD 利用

LD_PRELOAD 技术是 Linux 系统上一种强大的权限提升和代码执行方法：```
LD_PRELOAD Injection Flow:

1. Attacker writes malicious .so (shared object) to /etc/ld.so.preload
   
   /etc/ld.so.preload contents:
   /path/to/attacker.so

2. Java process starts (Jellyfin runs on Java):
   
   kernel > execve("java", ...) > glibc initialization
                                     |
                                     v
                          Check /etc/ld.so.preload
                                     |
                                     v
                          Load attacker.so FIRST
                                     |
                                     v
                          Execute attacker code
                          (BEFORE Java main())

3. Code Execution Context:
   
   Process Owner:   root (Jellyfin typically runs as root)
   Permissions:     Full system access
   Timing:          Before application initialization
   Detection:       Minimal (malicious code runs early)

4. Attacker Capabilities:
   
   > Create reverse shell with full root privileges
   > Extract sensitive data before application starts
   > Modify Java application behavior
   > Persist via cron jobs or systemd services
   > Establish C2 communication

为什么 LD_PRELOAD 可作为提权手段```

User Level Access > Path Traversal > Write /etc/ld.so.preload | v (Next process execution) | Kernel reads /etc/ld.so.preload > Loads attacker .so | v Malicious code executes in root context | v Full system compromise

---

## 影响分析

### 机密性
**严重** - 完全信息泄露
- 数据库提取：管理员凭据、用户密码、API 密钥
- 字幕文件和媒体元数据暴露
- 访问包含敏感数据的配置文件
- 收集系统信息以进行进一步利用

### 完整性
**严重** - 系统级文件修改
- 任意文件写入磁盘上的任何位置
- 应用程序二进制修改
- 系统配置篡改
- 数据库损坏或篡改

### 可用性
**严重** - 服务中断和拒绝
- 通过 LD_PRELOAD 中的恶意 .so 导致系统关机或崩溃
- 通过写入大文件耗尽磁盘空间
- 进程终止或资源耗尽
- 完全服务不可用

### 受影响组件
- Jellyfin 媒体服务器进程（大多数部署中以 root 身份运行）
- 操作系统内核和库
- 存储的媒体和元数据
- 用户认证系统
- 链接到 glibc 的系统级进程

### 业务影响
- **数据泄露：** 所有存储的凭据和用户数据遭到泄露
- **服务中断：** Jellyfin 及其他潜在服务变得不可用
- **横向移动：** 受感染系统成为网络攻击的跳板
- **合规违规：** 如果个人身份信息（PII）泄露，可能违反 GDPR、CCPA、HIPAA
- **供应链风险：** 如果 Jellyfin 用于提供共享或企业媒体服务

---

## 受影响版本

| 版本 | 状态 | 备注 |
|---------|--------|-------|
| < 10.8.0 | 易受影响 | 存在原始漏洞 |
| 10.8.0 - 10.11.6 | 易受影响 | 可能存在路径遍历和 RCE |
| 10.11.7+ | 已修补 | 格式字段已正确验证 |
| 10.12.0+ | 已修补 | 包含安全修复的最新版本 |

### 版本检测
可通过检查 `/System/Info/Public` 端点返回的版本字符串来检测该漏洞：```
GET /System/Info/Public HTTP/1.1
Host: jellyfin-server:8096

Response:
{
  "ServerName": "MyJellyfin",
  "Version": "10.10.3",  < Vulnerable
  "ProductName": "Jellyfin",
  "StartupWizardCompleted": true
}

检测

Python 扫描器

CVE-2026-35031_Jellyfin_RCE_detector.py 脚本提供自动化漏洞检测。

安装与要求```bash

pip install requests urllib3

#### 用法```bash
python CVE-2026-35031_Jellyfin_RCE_detector.py -t 10.0.0.5:8096
python CVE-2026-35031_Jellyfin_RCE_detector.py -t http://10.0.0.0/24
python CVE-2026-35031_Jellyfin_RCE_detector.py -t targets.txt -o results.json

命令行选项```

-t, --target HOST[:PORT] or CIDR or FILE Single target, IP range, or file with targets -p, --port PORT Custom port (default: 8096) --timeout SECONDS Connection timeout (default: 10) -o, --output FILE Save results to JSON file -v, --verbose Enable verbose logging --no-ssl-verify Disable SSL certificate verification

#### 示例输出```
[*] CVE-2026-35031 Jellyfin RCE Detection Scanner
[*] Target: http://10.0.0.5:8096
[*] Scan Time: 2026-04-15T12:00:00Z
[*] Detection method: /System/Info/Public version check
[*] Vulnerable: Jellyfin < 10.11.7

======================================================================
Target: http://10.0.0.5:8096
Scan Time: 2026-04-15T12:00:00Z
Risk Level: CRITICAL
======================================================================
  Is Jellyfin:           YES
  Jellyfin Version:      10.10.3
  Server Name:           MediaServer
  Operating System:      Linux
  Subtitle Endpoint:     Accessible
  Vulnerable:            YES

  *** VULNERABLE: Path traversal in subtitle upload ***
  *** Chains to arbitrary file write and RCE as root via ld.so.preload ***
  *** Upgrade to Jellyfin 10.11.7 immediately ***

======================================================================
Summary:
  Total Targets: 1
  Vulnerable: 1
  Patched: 0
  Unknown: 0
======================================================================

检测逻辑

扫描器执行以下检查：

服务检测： 连接目标端口并检查 HTTP 标头
Jellyfin 验证： 查询 /System/Info/Public 端点
版本提取： 从 JSON 响应中解析 Version 字段
漏洞评估： 将版本与补丁版本（10.11.7）进行比较
端点验证： 确认字幕上传端点存在
风险计算： 根据版本确定 CVSS 影响

Nmap NSE 脚本

CVE-2026-35031_Jellyfin_RCE.nse 脚本提供与 Nmap 的集成，用于漏洞扫描。

安装```bash

Copy to Nmap scripts directory

sudo cp CVE-2026-35031_Jellyfin_RCE.nse /usr/share/nmap/scripts/

Update Nmap database

sudo nmap --script-updatedb

#### 用法```bash
# Basic scan
nmap -p 8096 --script CVE-2026-35031_Jellyfin_RCE 10.0.0.5

# Comprehensive scan with service detection
nmap -sV -p 8096 --script CVE-2026-35031_Jellyfin_RCE 10.0.0.5

# Scan entire subnet
nmap -sV -p 8096 --script CVE-2026-35031_Jellyfin_RCE 10.0.0.0/24

# Aggressive scanning with timing
nmap -sV -p- --script CVE-2026-35031_Jellyfin_RCE -T4 10.0.0.5

# Export results to XML
nmap -sV -p 8096 --script CVE-2026-35031_Jellyfin_RCE -oX results.xml 10.0.0.5

示例输出```

PORT STATE SERVICE VERSION 8096/tcp open http Jellyfin Media Server 10.10.3 | CVE-2026-35031_Jellyfin_RCE: | VULNERABLE: | Jellyfin Subtitle Path Traversal to RCE (CVE-2026-35031) | State: VULNERABLE | Risk level: CRITICAL | CVSS Score: 9.9 | Jellyfin Version: 10.10.3 | Fixed Version: 10.11.7 | Description: | Jellyfin 10.10.3 is vulnerable to CVE-2026-35031. The subtitle | upload endpoint (/Videos/{itemId}/Subtitles) does not validate | the Format field, allowing path traversal and arbitrary file write. | This chains into remote code execution as root via LD_PRELOAD. | Vulnerability Chain: | 1. POST /Videos/{itemId}/Subtitles with Format=/../../../etc/ld.so.preload | 2. Arbitrary file write to /etc/ld.so.preload | 3. Database extraction via .strm files | 4. Admin privilege escalation | 5. RCE as root via LD_PRELOAD injection | Affected Endpoint: /Videos/{itemId}/Subtitles | Authentication Required: YES (non-admin user) | References: | https://nvd.nist.gov/vuln/detail/CVE-2026-35031 | https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65m |_ https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7

#### 脚本参数```bash
# Custom timeout for slow networks
nmap --script CVE-2026-35031_Jellyfin_RCE --script-args timeout=30 10.0.0.5

# Debug mode for troubleshooting
nmap --script CVE-2026-35031_Jellyfin_RCE -d 10.0.0.5

# Aggressive version detection
nmap -sV --version-intensity 9 --script CVE-2026-35031_Jellyfin_RCE 10.0.0.5

失陷指标

日志指标

Jellyfin 服务器日志 (/var/log/jellyfin/jellyfin.log)``` [ERR] Error processing subtitle upload: Invalid path characters detected [ERR] Exception in subtitle handling: DirectoryNotFoundException [ERR] Unauthorized file system access attempt [WARN] Unusual subtitle format detected: /../../../ [ERR] Security violation: Path traversal attempt blocked

**系统日志** (`/var/log/syslog` or `/var/log/messages`)```
subtitle upload process: segmentation fault (core dumped)
kernel: [security] Attempted to load from LD_PRELOAD: /etc/ld.so.preload
ld.so.preload: permission denied or file corrupted
Java process crashed after LD_PRELOAD initialization
Unexpected behavior from root-level Java process

文件系统指标

被修改的系统文件``` /etc/ld.so.preload - Should not contain any paths if not configured /lib/x86_64-linux-gnu/ - Look for suspicious .so files created recently /var/lib/jellyfin/subtitles - Check for files outside normal naming /etc/passwd - Verify no unauthorized access or modification /var/lib/jellyfin/db - Database timestamps may indicate extraction

**字幕目录中的可疑文件路径**```
/../../../etc/ld.so.preload
/../../../root/.ssh/authorized_keys
/../../../var/lib/jellyfin/jellyfin.db
../../../proc/self/environ

网络指标

可疑HTTP请求``` POST /Videos/[0-9]+/Subtitles

Format parameter contains: /.. or ..\ patterns
Format parameter contains absolute paths starting with /
Format parameter does not match known subtitle formats

Encoded Payloads: %2e%2e%2f (URL encoded ../) ..%252f (Double encoded ../) ....// (Bypass patterns)

**来自 Jellyfin 进程的出站连接**```
Reverse shells to external IPs
Connections to known C2 infrastructure
DNS requests to anomalous domains
Sudden spike in network traffic after failed subtitle upload

进程指标

Jellyfin 进程异常``` java process executing system commands java process spawning shell processes (/bin/bash, /bin/sh) java process opening connections to unusual ports java process reading system files like /etc/shadow Unusual CPU or memory usage spikes Child processes with different UID than parent

### 数据库指标

**Jellyfin 数据库更改** (`jellyfin.db`)```
New admin user created outside normal workflow
Admin password changed without admin action
API keys/tokens created unexpectedly
Unusual activity in audit logs

修复措施

立即行动（优先级：严重）

立即升级 Jellyfin ```bash

Docker deployment

docker pull jellyfin/jellyfin:latest docker-compose down docker-compose up -d

Package manager (Ubuntu/Debian)

sudo apt-get update sudo apt-get install --only-upgrade jellyfin

Package manager (Fedora/RHEL)

sudo dnf upgrade jellyfin
停止 Jellyfin 服务 ```bash sudo systemctl stop jellyfin
检查漏洞利用 ```bash

Check if ld.so.preload was modified

ls -la /etc/ld.so.preload cat /etc/ld.so.preload

Check subtitle directory for suspicious files

find /var/lib/jellyfin/subtitles -type f -newer /proc -ls

Check Jellyfin data directory

find /var/lib/jellyfin -type f -newermt "2026-04-14" -ls

短期缓解措施（优先级：高）

限制字幕上传权限 ``` Jellyfin Web UI > Settings > Users Disable "Upload Subtitles" for all non-admin users Review all users with this permission
网络分段 ```

Only allow trusted networks to access Jellyfin

sudo ufw allow from 192.168.1.0/24 to any port 8096 sudo ufw deny from any to any port 8096
文件系统权限 ```bash

Ensure Jellyfin runs with minimal privileges

sudo usermod -s /usr/sbin/nologin jellyfin

Restrict ld.so.preload permissions

sudo chmod 644 /etc/ld.so.preload sudo chmod 644 /etc/ld.so.conf

Set proper permissions on Jellyfin directory

sudo chown -R jellyfin:jellyfin /var/lib/jellyfin sudo chmod 750 /var/lib/jellyfin
监控利用尝试 ```bash

Watch subtitle upload endpoint logs

tail -f /var/log/jellyfin/jellyfin.log | grep -i subtitle

长期加固（优先级：中）

实施 Web 应用防火墙 (WAF) ``` Block requests containing:
- Path traversal patterns: ../ ..\ ..\
- Suspicious file paths: /etc/ /root/ /proc/
- Encoded variations: %2e%2e%2f
启用安全模块 ```bash

AppArmor (Ubuntu/Debian)

sudo aa-enforce /etc/apparmor.d/usr.bin.java

SELinux (Fedora/RHEL)

sudo semanage fcontext -a -t jellyfin_home_t "/var/lib/jellyfin(/.*)?" sudo restorecon -R /var/lib/jellyfin
以非 root 用户身份运行 Jellyfin ```bash

Create dedicated user if not exists

sudo useradd -r -s /usr/sbin/nologin jellyfin

Update systemd service

sudo sed -i 's/User=.*/User=jellyfin/' /etc/systemd/system/jellyfin.service sudo systemctl daemon-reload sudo systemctl restart jellyfin
实施定期备份 ```bash

Automated daily backups

sudo crontab -e

0 2 * * * /usr/local/bin/jellyfin-backup.sh

验证步骤```bash

1. Verify Jellyfin version after upgrade

curl -s http://localhost:8096/System/Info/Public | jq .Version

2. Confirm no unauthorized ld.so.preload entries

cat /etc/ld.so.preload | wc -l # Should be 0 or contain only legitimate entries

3. Check Jellyfin process permissions

ps aux | grep jellyfin | grep -v grep

4. Verify subnet connectivity restrictions

sudo ufw status

5. Test subtitle upload with non-admin user (should work normally)

Try uploading a legitimate .srt file and confirm it's stored correctly

---

## 参考资料

### 官方来源
- **NVD 条目：** https://nvd.nist.gov/vuln/detail/CVE-2026-35031
- **GitHub 安全公告：** https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65m
- **Jellyfin 发布版 v10.11.7：** https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7
- **Jellyfin 文档：** https://docs.jellyfin.org

### 相关漏洞与研究
- CWE-22：路径遍历 - https://cwe.mitre.org/data/definitions/22.html
- LD_PRELOAD 漏洞利用：https://www.gnu.org/software/libc/manual/html_node/Dynamic-Linker.html
- Java 进程权限提升模式
- 字幕文件格式规范（RFC 标准）

### 安全工具与资源
- Nmap：https://nmap.org
- Metasploit Framework：https://www.metasploit.com
- OWASP 路径遍历指南：https://owasp.org/www-community/attacks/Path_Traversal

---

## 作者

**漏洞发现与文档编写者：**

**Kerem Oruc**（@keraattin）
- GitHub：https://github.com/keraattin
- Twitter/X：https://twitter.com/keraattin

### 贡献

如果您对此文档或检测工具有改进建议，请提交拉取请求或创建 issue。

---

**免责声明：** 本文档仅用于教育和经授权的安全测试目的。未经授权访问计算机系统属于违法行为。在进行安全评估之前，请务必获得适当授权。

**最后更新：** 2026-04-15 | **状态：** 已发布

CVE ID	CVE-2026-35031
CVSS 评分	9.9（严重）
CWE	CWE-22：对受限目录的路径名限制不当（'路径遍历'）
受影响产品	Jellyfin 媒体服务器
受影响版本	< 10.11.7
修复版本	10.11.7 及更高版本
漏洞类型	路径遍历 + 任意文件写入 + RCE
所需身份验证	是（非管理员用户）
所需权限	“上传字幕”权限
默认端口	8096/TCP
GitHub 公告	GHSA-9p5f-5x8v-x65m
补丁状态	已可用并发布
漏洞利用公开	是

CVE-2026-35031

最受欢迎

Monitor system logs for ld.so.preload changes

Verify backup integrity

Log all file access to sensitive locations

Monitor process execution from Jellyfin

CVE-2026-35031

最受欢迎

CVE-2026-35031：Jellyfin 字幕上传路径遍历至 RCE

摘要

目录

快速事实

什么是 Jellyfin？

主要功能

网络架构```

路径遍历机制```

为什么 LD_PRELOAD 可作为提权手段```

检测

Python 扫描器

安装与要求```bash

命令行选项```

检测逻辑

Nmap NSE 脚本

安装```bash

Copy to Nmap scripts directory

Update Nmap database

示例输出```

失陷指标

日志指标

文件系统指标

网络指标

进程指标

修复措施

立即行动（优先级：严重）

Docker deployment

Package manager (Ubuntu/Debian)

Package manager (Fedora/RHEL)

Check if ld.so.preload was modified

Check subtitle directory for suspicious files

Check Jellyfin data directory

短期缓解措施（优先级：高）

Only allow trusted networks to access Jellyfin

Ensure Jellyfin runs with minimal privileges

Restrict ld.so.preload permissions

Set proper permissions on Jellyfin directory

Watch subtitle upload endpoint logs

长期加固（优先级：中）

AppArmor (Ubuntu/Debian)

SELinux (Fedora/RHEL)

Create dedicated user if not exists

Update systemd service

Automated daily backups

0 2 * * * /usr/local/bin/jellyfin-backup.sh