CVE-2025-24960CWE-22

Missing Input validation for filename in backups endpoint in Jellystat

High · published February 3, 2025

CVSS v3.1
8.7
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admin(s), there is very little scope for abuse. However, the `DELETE` `files/:filename` can be used to delete any file. This issue has been addressed in version 1.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00523 · 43.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-02-03T20:40Z
EPSS history
Timeline
  • 03 FEB 20:40Z
    Missing Input validation for filename in backups endpoint in Jellystat
    cvelistv5