TI-2026-83672 Aliases CVE-2026-120320 GHSA-8gr5-327m-w3jx

Deserialization flaw in jxxghp MoviePilot Workflow Fork Endpoint

MEDIUM 56CWE-20Published 2026-11-02 · Updated 2026-11-06

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

jxxghp MoviePilot up to and including 3.1.2 is affected. The WorkflowExecutor.restore_context function in app/chain/workflow.py of the Workflow Fork Endpoint component does not properly validate input before deserializing it (CWE-20, CWE-502). A remote attacker with high privileges can trigger deserialization of manipulated data. A public exploit has been disclosed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00389 33rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed MoviePilot (jxxghp): 3.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jxxghp	MoviePilot	3.1.0; 3.1.1; 3.1.2	3.1.3	Patch available	CNA

MoviePilot Vendorjxxghp Affected 3.1.0; 3.1.1; 3.1.2 Fixed in 3.1.3 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jxxghp:moviepilot::::::::	—	—	jxxghp

cpe:2.3:a:jxxghp:moviepilot:*:*:*:*:*:*:*:* Versions — — ·jxxghp

Remediation

Upgrade MoviePilot to version 3.1.3, which fixes this issue through patch 6034dcc880c13079aeb398dbe32c346ebcd3a6d2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA MoviePilot (jxxghp) Fixed in 3.1.3

Timeline

2026-11-02 Threatist record created from CVE-2026-120320
2026-11-02 Alias added: GHSA-8gr5-327m-w3jx
2026-11-06 CISA SSVC decision points changed
2026-11-06 Priority changed: LOW → MEDIUM

References

Exploit 1

https://github.com/0xGenesi/CVE/blob/main/MoviePilot_Workflow_Fork_Pickle_Deserialization_RCE.md

Patch 3

Other 1

https://github.com/jxxghp/MoviePilot/

TI-2026-09852 MoviePilot Path Traversal via Cloud Storage Download Handlers CVSS 4.0HIGH 7.2
TI-2026-08860 MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint CVSS 4.0HIGH 7.0
TI-2026-74575 Command injection in MoviePilot allows remote code execution CVSS 4.0HIGH 8.7
TI-2026-13565 jxxghp MoviePilot Application API improper authorization CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences