CVE-2026-41167
Jellystat is a free and open source Statistics App for Jellyfin.
Published Apr 22, 2026 · updated Jun 17, 2026
Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via and , enabling full read of any table in the database - including , which stores the Jellystat admin credentials, the Jellyfin API key, and the Jellyfin host URL. Because the vulnerable call site dispatches via 's simple query protocol (no parameter array is passed), stacked queries are allowed, which escalates the injection from data disclosure to arbitrary command execution on the PostgreSQL host via . Under the role shipped by the project's (a PostgreSQL superuser), no additional privileges are required to reach the RCE primitive. Version 1.1.10 contains a fix.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 22, 2026 · NIST NVD
Detected
Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via and , enabling full read of any table in the database - including , which stores the Jellystat admin credentials, the Jellyfi
Jun 17, 2026 · NIST NVD
Updated
Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via and , enabling full read of any table in the database - including , which stores the Jellystat admin credentials, the Jellyfi
Sources
- CVE.orgVulnerability recordCVE-2026-41167
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41167
Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via `POST
nvd.nist.gov