MoviePilot vulnerabilities

A vulnerability was found in MoviePilot up to version 2.13.5 in an unknown function of the file /jxxghp/MoviePilot within the Application API component. The issue involves improper authorization, allowing remote exploitation.

MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers. The local destination path is constructed by concatenating the configured download directory with a filename from remote cloud API metadata without basename normalization or path validation. An attacker controlling a filename returned by the API can use ../ sequences to write outside the configured directory, potentially overwriting arbitrary files including configuration or plugin files.

MoviePilot v2 contains a server-side request forgery (SSRF) vulnerability in the image proxy endpoint. An authenticated attacker can request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the configured allowlist.