PT-2026-47060 · Unknown · Moviepilot

Yu Sun · Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-11416

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions MoviePilot (affected versions not specified)

Description Path traversal exists in the AliPan, U115, and Rclone cloud storage download handlers. The issue occurs because the local destination path is created by concatenating the configured download directory with a filename retrieved from remote cloud API metadata without performing path validation or basename normalization. An attacker controlling a filename returned by a remote cloud storage API can use traversal sequences such as ../ to write downloaded content outside the intended directory, which may lead to the overwriting of arbitrary configuration or plugin files accessible by the application process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-11416

Affected Products

Moviepilot

References · 5

• https://github.com/jxxghp/MoviePilot/commit/a0b3800f6bf4857bf4f889a63d44350eb8380f28 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-11416 · Security Note
• https://github.com/jxxghp/MoviePilot/issues/5894 · Note
• https://github.com/jxxghp/MoviePilot · Note
• https://twitter.com/VulmonFeeds/status/2063035011066937794 · Twitter Post