Read the docs
TI-2026-09852 Aliases CVE-2026-11416GHSA-cpw6-f634-6rvj

MoviePilot Path Traversal via Cloud Storage Download Handlers

Priority HIGH 65CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded content to be written outside the configured download directory, potentially overwriting arbitrary files including configuration or plugin files reachable by the application process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00469 40th percentileScored 2026-11-07
Fix Fixed MoviePilot (jxxghp): 2.13.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jxxghpMoviePilotbefore 2.13.42.13.4Patch availableCNA
  • MoviePilot Vendorjxxghp Affected before 2.13.4 Fixed in 2.13.4 Patch available CNA

Remediation

  • Fix · CNA MoviePilot (jxxghp) Fixed in 2.13.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-11416
  2. 2026-10-03 Alias added: GHSA-cpw6-f634-6rvj

References

Patch 1

Other 2

  • TI-2026-08860 MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint CVSS 4.0HIGH 7.0
  • TI-2026-83672 Deserialization flaw in jxxghp MoviePilot Workflow Fork Endpoint CVSS 4.0MEDIUM 5.1
  • TI-2026-74575 Command injection in MoviePilot allows remote code execution CVSS 4.0HIGH 8.7
  • TI-2026-13565 jxxghp MoviePilot Application API improper authorization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences