Executive brief
MoviePilot, an automated NAS media library management tool, contains a security flaw in how it handles file downloads from cloud storage services like AliPan, 115, and Rclone. An attacker who can control the names of files stored in these cloud accounts can use specially crafted filenames to force MoviePilot to write files to restricted locations on the host system. This could allow an attacker to overwrite critical system configurations or application files, potentially leading to a full system compromise or service disruption.
Technical details
A path traversal vulnerability (CWE-22) exists in MoviePilot's cloud storage download handlers (AliPan, U115, and Rclone). The root cause is the lack of filename sanitization when constructing local destination paths; the application concatenates the configured download directory with the 'name' field retrieved directly from remote cloud API metadata. An attacker with the ability to influence filenames in a connected cloud storage account can inject traversal sequences (e.g., '../') to write downloaded content outside the intended directory. This can result in the overwriting of arbitrary files reachable by the application process, such as configuration or plugin files. The vulnerability was addressed in commit a0b3800 by implementing basename normalization and path validation.
Affected products
- jxxghp MoviePilot v2
Timeline
- 2026-06-05: disclosed: Vulnerability reported via GitHub Issue #5894
- 2026-06-05: patched: Fix committed in a0b3800f6bf4857bf4f889a63d44350eb8380f28
- 2026-06-05: advisory: CVE-2026-11416 published