From 617ebf367ff24ecbe8e0de5aebc90fe28689bcb0 Mon Sep 17 00:00:00 2001 From: Marc Brooks Date: Wed, 1 Apr 2026 16:55:47 -0500 Subject: Fix path transversal exposure in Plugins The request path is not validated to a valid path and could allow escaping the transcode path and downloading of any arbitrary file in GetHlsPlaylistLegacy . GetHlsAudioSegmentLegacy and GetHlsVideoSegmentLegacy have the same issue, and are NOT behind an Authorize so they are publicly exploitable. Added a ValidateTranscodePath that verifies that requested file paths start with the transcode path setting. Also ensure that all filename comparisons are OrdinalIgnoreCase because we might be running on a filesystem where filename-casing doesn't have to match. Switched from InvariantCulture because the underlying OS filename comparisons are always byte-wise (with case insensitivity here). Fixed a similar issue in GetPluginImage --- Jellyfin.Api/Controllers/PluginsController.cs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'Jellyfin.Api/Controllers/PluginsController.cs') diff --git a/Jellyfin.Api/Controllers/PluginsController.cs b/Jellyfin.Api/Controllers/PluginsController.cs index 0105ecf7a7..5f6136ed11 100644 --- a/Jellyfin.Api/Controllers/PluginsController.cs +++ b/Jellyfin.Api/Controllers/PluginsController.cs @@ -226,10 +226,11 @@ public class PluginsController : BaseJellyfinApiController return NotFound(); } - if (!string.IsNullOrEmpty(plugin.Manifest.ImagePath)) + string? imagePath = plugin.Manifest.ImagePath; + if (!string.IsNullOrWhiteSpace(imagePath)) { - var imagePath = Path.Combine(plugin.Path, plugin.Manifest.ImagePath); - if (!System.IO.File.Exists(imagePath)) + imagePath = Path.GetFullPath(imagePath, plugin.Path); + if (imagePath.StartsWith(plugin.Path, StringComparison.OrdinalIgnoreCase) is false || System.IO.File.Exists(imagePath) is false) { return NotFound(); } -- cgit v1.2.3