CVE-2026-16224
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A vulnerability was found in MoviePilot up to version 2.13.5 in an unknown function of the file /jxxghp/MoviePilot within the Application API component. The issue involves improper authorization, allowing remote exploitation.
Risk Assessment
The organization faces the risk of unauthorized access to API functions, potentially leading to data confidentiality or integrity breaches.
Recommendation
It is recommended to immediately apply the patch identified as dc2b6910a423b3bfadeffaa303e1ba75cfb33900 and update to the latest version of MoviePilot.
Other vulnerabilities in MoviePilot
See all- CVE-2026-11416High
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers. The local destination path is constructed by concatenating the configured download directory with a filename from remote cloud API metadata without basename normalization or path validation. An attacker controlling a filename returned by the API can use ../ sequences to write outside the configured directory, potentially overwriting arbitrary files including configuration or plugin files.
- CVE-2026-10107High
MoviePilot v2 contains a server-side request forgery (SSRF) vulnerability in the image proxy endpoint. An authenticated attacker can request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the configured allowlist.
Original NVD description (English source)
A vulnerability was identified in jxxghp MoviePilot up to 2.13.5. The affected element is an unknown function of the file /jxxghp/MoviePilot of the component Application API. The manipulation leads to improper authorization. Remote exploitation of the attack is possible. The identifier of the patch is dc2b6910a423b3bfadeffaa303e1ba75cfb33900. Applying a patch is the recommended action to fix this issue.