CVE-2025-24960: CyferShepard Jellystat, обхождане на път

Описание

Оригинално описание

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admin(s), there is very little scope for abuse. However, the `DELETE` `files/:filename` can be used to delete any file. This issue has been addressed in version 1.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Засегнати продукти

• CyferShepard Jellystat: < 1.1.3

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Други уязвимости в CyferShepard Jellystat

• 9.1CVE-2026-41167

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2025-24960
• https://nvd.nist.gov/vuln/detail/CVE-2025-24960
• https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-6x46-6w9f-ffv6
• https://github.com/CyferShepard/Jellystat/pull/303
• https://cwe.mitre.org/data/definitions/22.html