From 01af74ec61637750ae15b6cdb69a564408905df2 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Fri, 25 Sep 2026 09:56:44 -0400
Subject: [PATCH] jellyfin: backport two security fixes from 12.0

Fix GHSA-6828-c7cx-hvqm and GHSA-4vx8-xhc9-qg6x.

Not-cherry-picked-because: master is on 12.1 and already contains the fixes.
---
 pkgs/by-name/je/jellyfin/package.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/by-name/je/jellyfin/package.nix b/pkgs/by-name/je/jellyfin/package.nix
index d0dabbd88fc7..31ae8c923ca0 100644
--- a/pkgs/by-name/je/jellyfin/package.nix
+++ b/pkgs/by-name/je/jellyfin/package.nix
@@ -32,6 +32,18 @@ buildDotnetModule (finalAttrs: {
       hash = "sha256-TxGo+sLLG+C9omxrwvO6byzw+iRqONVLXrQKwkrY22s=";
     })
 
+    # GHSA-6828-c7cx-hvqm: confine virtual-folder operations to the libraries root.
+    (fetchpatch {
+      url = "https://github.com/jellyfin/jellyfin/commit/0c560b22ce73323329645b836c9910abc257ce4e.patch";
+      hash = "sha256-K/og9MDP4BNexkDGLOm346O9anqAjb13UViSAmOw2OA=";
+    })
+
+    # GHSA-4vx8-xhc9-qg6x: enforce remote-control permissions between user sessions.
+    (fetchpatch {
+      url = "https://github.com/jellyfin/jellyfin/commit/dd7de4187879082e10b474856f705b6c5d9b963a.patch";
+      hash = "sha256-OCj4aaKaX4F/+KbCz6BAsifdYe/6BOu6y39ZgMSUKFA=";
+    })
+
     # Fix MaxLoginAttempts not honored.
     # https://github.com/jellyfin/jellyfin/pull/17274
     (fetchpatch {