CVE-2026-11416
HighCVSS 8.1Summary
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata. An attacker can exploit this vulnerability to write downloaded content outside the configured download directory.
Risk Assessment
This vulnerability may lead to overwriting arbitrary files, including configuration or plugin files, posing a serious threat to the integrity of the application and data security.
Recommendation
It is recommended to implement filename validation and path normalization in the download handlers to prevent path traversal.
Original NVD description (English source)
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded content to be written outside the configured download directory, potentially overwriting arbitrary files including configuration or plugin files reachable by the application process.