Your downvotes are meaningless, please don’t run Jellyfin publicly exposed without at least some form of secondary ACL whether it be a full blown VPN or just a lazy reverse proxy login like authentik.
And please run inside a non privliged container. Either use uidmap or go rootless.
I’m pretty sure there are multiple hackthebox machines based around jellyfin because of how notorious it used to be with bugs.
You shouldn’t be talking with the amount of hilarious CVEs jellyfin has also had lmao
EDIT:
Literally a critical RCE a couple of months ago lol: https://nvd.nist.gov/vuln/detail/cve-2026-35031
Your downvotes are meaningless, please don’t run Jellyfin publicly exposed without at least some form of secondary ACL whether it be a full blown VPN or just a lazy reverse proxy login like authentik.
And please run inside a non privliged container. Either use uidmap or go rootless.
I’m pretty sure there are multiple hackthebox machines based around jellyfin because of how notorious it used to be with bugs.
I don’t understand, though… Your mom has a bunch of unresolved CVEs and we all bang her anyway, so??
behold! the jellyfin community in a nutshell.
I don’t use jellyfin.