This appears to be an unauthenticated remote code execution bug on par with PHP2shell according to the dotnet CVE

not sure if jellyfin is affectedby the vuln though