Is CVE-2026-11416 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11416 being exploited in the wild.

How severe is CVE-2026-11416?

High severity, with a CVSS score of 8.1, published 5 June 2026.

Is there a fix for CVE-2026-11416?

A patch was published on 2026-06-05: Fix committed in a0b3800f6bf4857bf4f889a63d44350eb8380f28 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11416 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11416?

Check whether you run Jxxghp MoviePilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11416: jxxghp MoviePilot path traversal in cloud storage download handlers

CVE-2026-11416 · Severity: high · CVSS 8.1 · Published 2026-06-05

MoviePilot, an automated NAS media library management tool, contains a security flaw in how it handles file downloads from cloud storage services like AliPan, 115, and Rclone. An attacker who can control the names of files stored in these cloud accounts can use specially crafted filenames to force MoviePilot to write files to restricted locations on the host system. This could allow an attacker to overwrite critical system configurations or application files, potentially leading to a full system compromise or service disruption.

Technologies: Jxxghp MoviePilot. Vendors: Jxxghp.

Quick answers

Is CVE-2026-11416 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11416 being exploited in the wild.
How severe is CVE-2026-11416?: High severity, with a CVSS score of 8.1, published 5 June 2026.
Which products and versions are affected?: Jxxghp MoviePilot v2.
Is there a fix for CVE-2026-11416?: A patch was published on 2026-06-05: Fix committed in a0b3800f6bf4857bf4f889a63d44350eb8380f28 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11416 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11416?: Check whether you run Jxxghp MoviePilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in MoviePilot's cloud storage download handlers (AliPan, U115, and Rclone). The root cause is the lack of filename sanitization when constructing local destination paths; the application concatenates the configured download directory with the 'name' field retrieved directly from remote cloud API metadata. An attacker with the ability to influence filenames in a connected cloud storage account can inject traversal sequences (e.g., '../') to write downloaded content outside the intended directory. This can result in the overwriting of arbitrary files reachable by the application process, such as configuration or plugin files. The vulnerability was addressed in commit a0b3800 by implementing basename normalization and path validation.

Affected products

jxxghp MoviePilot v2

Timeline

2026-06-05: disclosed: Vulnerability reported via GitHub Issue #5894
2026-06-05: patched: Fix committed in a0b3800f6bf4857bf4f889a63d44350eb8380f28
2026-06-05: advisory: CVE-2026-11416 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.