Authenticated code execution via subtitle format traversal

Path traversal in Jellyfin before 10.11.7 allows remote authenticated users to write arbitrary files through subtitle uploads. The subtitle upload endpoint appends the unchecked Format value as a file extension and checks the raw path before the operating system resolves traversal segments. An administrator or a user granted Upload Subtitles permission can extract the database through a .strm file and, on Linux, execute code as root through ld.so.preload.