Jellyfin 12.0 Released With Security Fixes for Unauthorized File Access and XSS Flaws
Jellyfin 12.0 fixes unauthorized file access and web client XSS flaws, but requires careful upgrades due to breaking database migrations and plugin changes.
The open-source media server release prevents crafted requests from reading files outside designated directories, blocks unauthorized re-runs of the setup wizard, rejects plugin packages with unsafe names, strengthens parental control enforcement, and fixes cross-site scripting vulnerabilities in browser-based administration and media access workflows. Upgrades require a manual backup because the database schema migration is irreversible; supported paths start from version 10.10.7 or 10.11.x, and duplicate case-insensitive usernames will break migration. The release also retires legacy /emby/ and /mediabrowser/ routes, disables deprecated authentication by default, and targets .NET 10, requiring plugin rebuilds.
- Server now reports version 12.0.0; SDKs and integrations must be regenerated
- Full library rescan required after migration; automatically grouped versions are reconstructed from disk
- Internet-exposed deployments should still sit behind a reverse proxy
From the original article
2 min read at gbhackers.com
Jellyfin has released version 12. 0, a significant update to its open-source media server. This version includes a wide range of platform improvements and essential security updates affecting both the server and the web client.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.