CVE-2023-30627
mediumpriority · track · 22EPSS 0.013 · 70 %ileEUUSEPSS · scored 2026-10-27
jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the `REST` endpoints with admin privileges. When combined with CVE-2023-30626, this results in remote code execution on the Jellyfin instance in the context of the user who's running it. This issue is patched in version 10.8.10. There are no known workarounds.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5–9.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-30627/cnnvd
- https://github.com/jellyfin/jellyfin-web/commit/b88a5951e1a517ff4c820e693d9c0da981cf68eecnnvd
- https://github.com/jellyfin/jellyfin-web/releases/tag/v10.8.10cnnvd
- https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pqcnnvd
- https://github.com/jellyfin/jellyfin/security/advisories/GHSA-9p5f-5x8v-x65mcnnvd
- https://github.com/jellyfin/jellyfin-web/commit/b88a5951e1a517ff4c820e693d9c0da981cf68eeenisa_euvd
- https://github.com/jellyfin/jellyfin-web/releases/tag/v10.8.10enisa_euvd
- https://github.com/jellyfin/jellyfin-web/security/advisories/GHSA-89hp-h43h-r5pqenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan