Path Traversal Vulnerability in MoviePilot by MoviePilot Team

CVE-2026-11416

What is CVE-2026-11416?

MoviePilot possesses a path traversal vulnerability which arises from the download handlers for AliPan, U115, and Rclone cloud storage. The issue stems from a flawed method of constructing local destination paths, whereby user-controlled filenames from remote cloud API metadata are directly used without adequate validation or basename normalization. Consequently, an attacker can exploit this flaw by manipulating the filename to include traversal sequences such as ../, resulting in the potential for downloaded files to be saved outside the designated download directory. This may lead to overwriting arbitrary files, including critical configuration and plugin files, thereby compromising the integrity and security of the application.

References