CVE-2021-29490 Scanner
CVE-2021-29490 scanner - Server-Side-Request-Forgery (SSRF) vulnerability in Jellyfin
Used 3k times · 5.9k assets checked · url
CVE
CVE-2021-29490
5.8
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description
Jellyfin is a free software media system that provides media from a dedicated server to end-user devices via multiple apps. Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. This issue potentially exposes both internal and external HTTP servers or other resources available via HTTP `GET` that are visible from the Jellyfin server. The vulnerability is patched in version 10.7.3. As a workaround, disable external access to the API endpoints `/Items/*/RemoteImages/Download`, `/Items/RemoteSearch/Image` and `/Images/Remote` via reverse proxy, or limit to known-friendly IPs.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
jellyfin
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: jellyfin
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →