Jellyfin is a Free Software media server, forked from Emby in December 2018 after Emby closed its source, developed entirely by unpaid volunteer contributors and licensed under the GNU GPLv2. Users run Jellyfin on their own hardware to manage and stream their own media library, keeping the media and library data under the operator's own control rather than a vendor's cloud. Its fiscal sponsor is the Open Source Collective, and its own FAQ states that donation funds collected on Open Collective are used only for infrastructure, with all developers unpaid on principle. By default the server queries third-party metadata providers (The Movie Database and the Open Movie Database API) to enrich library entries, sending media titles and identifiers off-server unless an administrator disables it. The project's web client dependency manifest lists no analytics or telemetry package, and the project runs a public GitHub Security Advisories program that has published and fixed several vulnerabilities, including a Critical remote-code-execution issue via subtitle upload in 2026, giving it a documented, transparent disclosure history rather than a clean-record default.
TIMELINE
1 ENTRY
[2026-08-31] · NEW RECEIPTS
8 new sources on file for Jellyfin.
Jellyfin's file gained 8 new sourced claims since its last review.
Jellyfin's own About page states the project is a Free Software Media System that puts the operator in control of managing and streaming their media, positioning it as a self-hosted alternative to the proprietary Emby and Plex where the server runs on the user's own hardware rather than a vendor-operated cloud service.
Jellyfin's FAQ states that funds raised through its Open Collective donations page are used only for infrastructure, and that all of the project's developers are unpaid volunteers on principle, disclosing the project's funding structure directly.
Jellyfin's Open Collective page discloses its fiscal host as Open Source Collective, the formal nonprofit fiscal sponsor that legally receives and disburses donations on the project's behalf, with a public log of financial contributors and amounts.
Jellyfin's About page names its Core Team members by public GitHub identity and role (Bond-009 and Claus Vium on Server, Bill Thornton on Web, Cody Robibero on Server and Plugins, Niels van Velzen on Clients), the group with merge permissions and final decision authority over the core server and web client.
Jellyfin's Metadata documentation states that by default the server ships with The Movie Database (TMDb) and the Open Movie Database API (OMDb API) as metadata providers, meaning library media titles and identifiers are queried against these third-party services out of the box unless an administrator changes the configuration.
Jellyfin's About page states there are no strings attached, no premium licenses or features, and no hidden agendas behind the project, framing it as a non-commercial effort with no ad- or data-monetization business model that would create an incentive to share user or library data with a partner.
Jellyfin's GitHub Security Advisories page publicly lists disclosed vulnerabilities with severity and publication date, including a Critical-severity remote-code-execution issue reached via a subtitle-upload path-traversal chain (GHSA-j2hf-x4q5-47j3), published April 14, 2026 by the project's named security maintainer, alongside multiple other High/Moderate advisories from the same period — a documented, dated public disclosure record rather than an unverifiable clean record.
The official jellyfin-web client's published package.json dependency manifest was fetched in full (179 lines) and lists no analytics, crash-reporting, or telemetry package among its dependencies, consistent with the project's fully open-source codebase.