Jellyfin 12.0 security fixes arrive alongside the removal of legacy client logins
Jellyfin 12.0 ships security fixes for path traversal, first-run setup bypass, unsafe plugin names, and web client XSS, plus removal of legacy login paths.
Jellyfin 12.0 blocks requests built to reach files outside served folders, prevents setup-wizard re-runs on misconfigured servers, rejects unsafe plugin package names, and fixes web client cross-site scripting. The project published no CVE identifiers or severity ratings for the fixes. The release also drops legacy /emby/ and /mediabrowser/ endpoints, targets .NET 10, and breaks 10.11-era third-party plugins.
- No CVEs or severity ratings assigned to the security fixes
- Legacy /emby/ and /mediabrowser/ logins removed in 12.0
- Built-in TLS removal postponed to a future version
- Upgrade path requires 10.10.7 or any 10.11.x first
From the original article
2 min read at helpnetsecurity.com
Jellyfin shipped version 12. 0 of its media server. Several of the security fixes in it block requests built to reach files outside the folders the server is supposed to hand out.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.