CVE-2026-11416
MoviePilot Path Traversal via Cloud Storage Download Handlers
Description
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded content to be written outside the configured download directory, potentially overwriting arbitrary files including configuration or plugin files reachable by the application process.
INFO
Published Date :
June 5, 2026, 10:16 p.m.
Last Modified :
July 23, 2026, 7:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Normalize filenames from cloud API metadata.
- Validate destination paths before writing files.
- Sanitize user-supplied input for filenames.
- Update MoviePilot to the latest version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-11416.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-11416 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-11416
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-11416 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-11416 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: MoviePilot de jxxghp, Description: MoviePilot contiene una vulnerabilidad de salto de ruta en los manejadores de descarga de almacenamiento en la nube AliPan, U115 y Rclone donde la ruta de destino local se construye concatenando el directorio de descarga configurado con un nombre de archivo tomado directamente de los metadatos de la API de la nube remota sin normalización de nombre base ni validación de ruta. Un atacante que controla un nombre de archivo devuelto por una API de almacenamiento en la nube remota puede incluir secuencias de salto ../ en el nombre de archivo para hacer que el contenido descargado se escriba fuera del directorio de descarga configurado, sobrescribiendo potencialmente archivos arbitrarios, incluidos archivos de configuración o de plugin accesibles por el proceso de la aplicación. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'jxxghp', 'modules': ['app/modules/filemanager/storages/alipan.py', 'app/modules/filemanager/storages/u115.py', 'app/modules/filemanager/storages/rclone.py'], 'product': 'MoviePilot', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '2.13.4', 'versionType': 'custom'}], 'collectionURL': 'https://github.com/jxxghp/MoviePilot', 'defaultStatus': 'unknown'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-11416', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-08T16:21:45.247549Z'} -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 08, 2026
Action Type Old Value New Value Added Reference https://github.com/jxxghp/MoviePilot/issues/5894 -
New CVE Received by [email protected]
Jun. 05, 2026
Action Type Old Value New Value Added Description MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded content to be written outside the configured download directory, potentially overwriting arbitrary files including configuration or plugin files reachable by the application process. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Added CWE CWE-22 Added Reference https://github.com/jxxghp/MoviePilot Added Reference https://github.com/jxxghp/MoviePilot/commit/a0b3800f6bf4857bf4f889a63d44350eb8380f28 Added Reference https://github.com/jxxghp/MoviePilot/issues/5894