Exploit for CVE-2021-21402-Jellyfin

kitploit · 2026-09-04

Description

Arbitrary file read vulnerability in Jellyfin.

Entry point

Parameterlanguage · request body

Path/Videos/{itemId}/Subtitles

Authenticated arbitrary file overwrite via Subtitles endpoint with elevated permissions; may lead to arbitrary file write/RCE.

Affected Jellyfin versions

Jellyfin< 10.7.1

All known vulnerabilities by product

CVSS 7.7 for CVE-2021-21402

7.7

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

CVE Information

Exploit Details

Modified:2026-09-04 07:51

Last Seen:2026-09-04 23:37

Reporter:KitPloit

Tags

Jellyfinarbitrary file readCVE-2021-21402Python POC

Other exploits for CVE-2021-21402

2026-09-08 KitPloitKITPLOIT

2026-09-08 KitPloitKITPLOIT

Exploit for Path Traversal in Jellyfin

2021-04-15 somatrasssGITHUB

Exploit for Path Traversal in Jellyfin

2021-04-09 jiaocollGITHUB

Jellyfin < 10.7.1 Directory Traversal

2021-04-08 Dsquare SecurityD2

Jellyfin 任意文件读取漏洞（CVE-2021-21402）

2021-04-02 KnownsecSEEBUG

Exploit Code

MARKDOWN6 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-JIAOCOLL-CVE-2021-21402-JELLYFIN
# CVE-2021-21402-Jellyfin-Произвольное чтение файлов

**Этот POC предназначен только для учебных целей, я не несу ответственности за любые последствия, возникшие в результате его использования**

python POC.py targets.txt