CVE-2026-41167

{
  "id": "CVE-2026-41167",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-22T21:17:09.303",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via `POST /api/getUserDetails` and `POST /api/getLibrary`, enabling full read of any table in the database - including `app_config`, which stores the Jellystat admin credentials, the Jellyfin API key, and the Jellyfin host URL. Because the vulnerable call site dispatches via `node-postgres`'s simple query protocol (no parameter array is passed), stacked queries are allowed, which escalates the injection from data disclosure to arbitrary command execution on the PostgreSQL host via `COPY ... TO PROGRAM`. Under the role shipped by the project's `docker-compose.yml` (a PostgreSQL superuser), no additional privileges are required to reach the RCE primitive. Version 1.1.10 contains a fix."
    },
    {
      "lang": "es",
      "value": "Jellystat es una aplicación de estadísticas gratuita y de código abierto para Jellyfin. Antes de la versión 1.1.10, múltiples puntos finales de la API en Jellystat construyen consultas SQL interpolando campos no saneados del cuerpo de la solicitud directamente en cadenas SQL sin procesar. Un usuario autenticado puede inyectar SQL arbitrario a través de ’POST /api/getUserDetails’ y ’POST /api/getLibrary’, permitiendo la lectura completa de cualquier tabla en la base de datos, incluyendo ’app_config’, que almacena las credenciales de administrador de Jellystat, la clave API de Jellyfin y la URL del host de Jellyfin. Debido a que el sitio de llamada vulnerable se despacha a través del protocolo de consulta simple de ’node-postgres’ (no se pasa ningún array de parámetros), se permiten consultas apiladas, lo que escala la inyección de divulgación de datos a ejecución de comandos arbitrarios en el host de PostgreSQL a través de ’COPY ... TO PROGRAM’. Bajo el rol enviado por el ’docker-compose.yml’ del proyecto (un superusuario de PostgreSQL), no se requieren privilegios adicionales para alcanzar la primitiva RCE. La versión 1.1.10 contiene una corrección."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "CyferShepard",
          "product": "Jellystat",
          "versions": [
            {
              "version": "< 1.1.10",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-23T13:45:57.789345Z",
          "id": "CVE-2026-41167",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/CyferShepard/Jellystat/commit/735fe7c6eb0e3e34e92a8a82fd21914d76693665",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-fj7c-2p5q-g56m",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-fj7c-2p5q-g56m",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}