Jellyfin 12.0 Released With Security Fixes for Unauthorized File Access and XSS Flaws

Jellyfin has released version 12.0, a significant update to its open-source media server. This version includes a wide range of platform improvements and essential security updates affecting both the server and the web client.

The project strongly advises administrators to plan their upgrade carefully because it includes database migrations and compatibility-breaking changes for existing deployments.

Jellyfin 12.0 Released

The security fixes in this update prevent crafted requests from accessing files outside of Jellyfin’s designated directories.

Additionally, the update blocks unauthorized re-runs of the setup wizard on misconfigured instances, rejects plugin packages with unsafe names, enhances parental control enforcement, and addresses cross-site scripting vulnerabilities in the web client that affect browser-based administration and media access workflows.

This update is not a routine in-place patch. Jellyfin 12.0 modifies the database schema and rewrites data on first boot, so the only way to revert to a previous version is through a backup. Administrators should stop the service and manually back up the data and configuration directories before starting the upgrade process.

Supported upgrade paths begin with Jellyfin version 10.10.7 or any 10.11.x version. Installations running older versions must first upgrade to 10.10.7.

Administrators must also identify any accounts whose usernames differ only by letter case since usernames are now case-insensitive. Duplicate usernames will cause the database migration to fail during initial processing.

A full library scan is required after the migration is complete. To ensure the storage model for alternate versions is correct, Jellyfin will clear automatically grouped versions and reconstruct them from files stored on disk.

The initial scan may take longer than usual, might classify some titles as newly added, and must not be interrupted while migrations are still in progress.

Jellyfin has also retired the legacy /emby/ and /mediabrowser/ addresses and has disabled deprecated authentication mechanisms by default. This creates a risk for unmaintained clients and integrations.

Developers are encouraged to test any software that parses version strings, uses legacy routes, or generates SDKs, as the server now reports version 12.0.0, and its updated OpenAPI output must be regenerated before deployment.

Plugin maintainers should note the separate plugin transition. The server now targets .NET 10, and several interfaces have changed. Plugins built for version 10.11 must be retargeted and rebuilt.

Jellyfin recommends that administrators remove third-party plugins before upgrading and only restore compatible versions after the upgrade; official plugins have already been updated to support version 12.0.

In addition to security improvements, version 12.0 reorganizes playlists and collections so that each item is stored as an individual database row.

This change aims to improve pagination, counting, and editing for large lists while reducing interface freezes. The release also extends alternate-version grouping to TV episodes, adds support for books and comics, and adopts a modern layout.

For deployments that are exposed to the internet, the project continues to recommend placing Jellyfin behind a reverse proxy. While the removal of internal TLS/SSL has been postponed, this adds migration time rather than changing best practices.

Organizations should stage upgrades, validate client configurations, monitor first-boot migrations, rescan libraries, and clear caches if needed after completing the upgrade.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.