CVE-2025-24960

HIGH

8.7

Descricao

Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admin(s), there is very little scope for abuse. However, the `DELETE` `files/:filename` can be used to delete any file. This issue has been addressed in version 1.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Detalhes CVE

Pontuacao CVSS v3.18.7

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado2/3/2025

Ultima modificacao2/3/2025

Fontenvd

Avistamentos honeypot0

Fraquezas (CWE)

CWE-22

Referencias

https://cwe.mitre.org/data/definitions/22.html(security-advisories@github.com)

https://github.com/CyferShepard/Jellystat/pull/303(security-advisories@github.com)

https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-6x46-6w9f-ffv6(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.