## https://sploitus.com/exploit?id=11F37628-699D-5923-ADFD-BEC25F3FDA9E
#CVE-2021-21402: Jellyfin Arbitrary File Reading Vulnerability
**Description**
Jellyfin is a free software media system used for controlling and managing media and streaming content. It serves as a replacement for Emby and Plex, providing media services to end-user devices through multiple applications. Jellyfin relies on the Emby 3.5.2 .NET Core framework to achieve full cross-platform compatibility. In version 10.7.1, attackers were able to construct malicious requests that allowed them to read arbitrary files from the Jellyfin server’s file system. This issue is more common when Windows is used as the host operating system. Servers exposed to the public Internet may be at risk. This vulnerability has been fixed in version 10.7.1. The solution involves implementing strict security permissions in the file system to restrict certain accesses.
**Affected Versions**
Jellyfin < 10.7.1
**Solutions**
1. Upgrade Jellyfin to the secure version (10.7.1):
https://jellyfin.org/downloads/
2. Users should implement strict security permissions in the file system to restrict certain accesses.