CVE-2026-11416
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers. The local destination path is constructed by concatenating the configured download directory with a filename from remote cloud API metadata without basename normalization or path validation. An attacker controlling a filename returned by the API can use ../ sequences to write outside the configured directory, potentially overwriting arbitrary files including configuration or plugin files.
Risk Assessment
An attacker could overwrite critical configuration or plugin files, potentially leading to application compromise or arbitrary code execution.
Recommendation
Update MoviePilot to a patched version, or manually add path validation and filename normalization in the download handlers.
Other vulnerabilities in MoviePilot
See all- CVE-2026-16224Medium
A vulnerability was found in MoviePilot up to version 2.13.5 in an unknown function of the file /jxxghp/MoviePilot within the Application API component. The issue involves improper authorization, allowing remote exploitation.
- CVE-2026-10107High
MoviePilot v2 contains a server-side request forgery (SSRF) vulnerability in the image proxy endpoint. An authenticated attacker can request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the configured allowlist.
Original NVD description (English source)
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded content to be written outside the configured download directory, potentially overwriting arbitrary files including configuration or plugin files reachable by the application process.