CVE-2026-41167: Jellystat SQL Injection via Request Body Fields
Jellystat versions before 1.1.10 build several SQL queries by inserting unsanitized request-body fields, which allows SQL injection by an authenticated user. The advisory describes possible full read access to the database, including stored administrator and Jellyfin credentials, and escalation to command execution on the PostgreSQL host. Version 1.1.10 contains the fix, and no confirmed active exploitation appears in the sources consulted.
Overview
Jellystat is a statistics application for Jellyfin. According to the GitHub advisory, several API endpoints in versions before 1.1.10 build SQL queries by inserting request-body fields without sanitization, a classic SQL injection pattern mapped to CWE-89.
Impact
- An authenticated user may read any database table, including the configuration table that holds administrator credentials, the Jellyfin API key and the Jellyfin host URL.
- The advisory states that the injection can be escalated to command execution on the PostgreSQL host under the database role shipped in the project's compose file, which is a superuser role.
- The CVSS 3.1 base score is 9.1 (critical), with high confidentiality, integrity and availability impact and a changed scope.
Affected products and versions
- Jellystat versions prior to 1.1.10, according to the advisory text.
- The record contains no structured affected version ranges, so the list of affected products is empty in the data.
- Version 1.1.10 is identified as containing the fix. Intermediate patch levels are not enumerated.
Exploitation status
- The vulnerability is not listed in the CISA KEV catalog in the record.
- No confirmed active exploitation or exploitation in the wild appears in the sources consulted.
- At the time of the record, EPSS gives a probability of 0.00933 and a percentile of 0.59712.
Remediation and mitigation
- Upgrade Jellystat to version 1.1.10 or later, as indicated by the advisory and the referenced commit.
- Until the upgrade is applied, limit access to the application to trusted users and review existing accounts.
- If exposure is suspected, rotate the Jellystat administrator credentials, the Jellyfin API key and any database credentials, since the advisory says these values are stored in a readable table.
- Where the deployment allows, run application database roles with the minimum privileges needed, as a defense-in-depth measure.
Detection guidance
- Review application and reverse proxy logs for unusual requests to the affected endpoints, especially payloads with unexpected structure or unusual characters in fields.
- Monitor the database for unexpected reads of configuration tables and for administrative or system-level operations initiated by the application role.
- Check for unexpected changes to Jellystat settings or newly created administrative accounts.
Limitations of the available information
- The record shows a source status of Deferred and does not explain how the severity was assessed beyond the CVSS vector.
- The vector specifies high privileges required (PR:H), while the description refers to an authenticated user. The exact privilege requirement should be confirmed against the advisory.
- Precise affected version boundaries, the full patch details and the status of public proof of concept are not established in the record.
Frequently asked questions
Which versions are affected?
The record states that Jellystat versions prior to 1.1.10 are affected. The structured affected list is empty, so exact version boundaries are not confirmed beyond that statement.
Is this vulnerability known to be exploited?
The record does not list it in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
What should administrators do?
Upgrade to version 1.1.10 or later, limit access to trusted users, and rotate stored credentials if exposure is suspected.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.