CVE-2026-11416: MoviePilot Path Traversal in Cloud Storage Download Handlers

Technical summary

CVE-2026-11416 exploits insufficient input validation in MoviePilot's cloud storage download handlers for AliPan, U115, and Rclone integrations. The vulnerability stems from unsafe path construction where user-controlled filenames from cloud API responses are concatenated directly with the configured download directory without basename normalization or validation. An authenticated attacker capable of controlling filenames in the remote cloud storage metadata can inject directory traversal sequences to cause arbitrary file writes at paths accessible to the MoviePilot process. The CVSS 3.1 score of 8.1 (HIGH) reflects the requirement for prior authentication (PR:L) but acknowledges significant integrity and availability impact potential.

Business impact

Organizations relying on MoviePilot for media management face risk of system compromise through file overwrite attacks. Attackers could replace configuration files to alter application behavior, inject malicious plugin code to achieve persistent execution, or corrupt critical files to disrupt service availability. The impact is particularly severe in shared or multi-user environments where MoviePilot processes user requests, as compromised files could affect all downstream operations. Remediation delays increase exposure window for targeted attacks against high-value media libraries or integrated backup systems.

Affected systems

MoviePilot installations using cloud storage integration features—specifically AliPan, U115, or Rclone handlers—are affected. The vulnerability requires an authenticated user or attacker with cloud storage account access to manipulate filenames in the remote metadata. Systems where MoviePilot runs with elevated privileges or where the application directory is world-writable face heightened risk of lateral privilege escalation or system-wide compromise.

Exploitability

Exploitation requires authentication (PR:L per CVSS vector) and ability to control filenames returned by the targeted cloud storage service. This could be achieved through compromised cloud credentials, insider threat, or in cases where an attacker controls the cloud storage account. The attack does not require user interaction (UI:N) and operates over the network (AV:N). Once the malicious filename is crafted, exploitation is straightforward: initiate a download operation and MoviePilot's unsafe concatenation logic automatically triggers the write to the traversal path. No special tools or public exploits are required; standard cloud storage access suffices.

Remediation

Implement immediate basename normalization and path validation for all downloaded filenames across AliPan, U115, and Rclone handlers. Apply the following controls: (1) extract only the filename component using secure basename functions, rejecting any path separators or traversal sequences; (2) validate that the resolved destination path remains within the configured download directory using realpath or equivalent canonicalization; (3) sanitize or reject filenames containing ../, .., or other traversal patterns; (4) consider implementing a whitelist of acceptable filename characters. Verify the fix prevents traversal in all three affected handlers. Update MoviePilot to a patched version once available from the vendor.

Patch guidance

Verify and apply the latest security update from MoviePilot's official release channel. Confirm the update addresses path traversal in all three cloud storage handlers (AliPan, U115, Rclone). Prior to patching, restrict cloud storage integration features or disable unused handlers if operationally feasible. After patching, clear any locally cached cloud metadata and test download functionality to confirm filenames are correctly normalized. Organizations should prioritize this patch for systems with direct internet exposure or those handling sensitive media archives.

Detection guidance

Monitor MoviePilot process logs and filesystem activity for unusual file write patterns: look for downloaded files appearing in directories outside the configured download path, or write attempts to system configuration directories, plugin directories, or parent directories of the download folder. Implement file integrity monitoring on MoviePilot's configuration and plugin directories to detect unauthorized modifications. Cloud storage audit logs may reveal suspicious filename patterns containing ../ or unusual path-like sequences in filenames. Network-level detection is limited since the exploit occurs after download initiation; focus on post-download file system forensics.

Why prioritize this

This vulnerability merits high priority due to its potential for system compromise through file overwrite, the low barrier to exploitation for authenticated users, and the direct accessibility of the attack surface (cloud storage download handlers). The CVSS 8.1 severity, combined with integrity and availability impact (I:H/A:H), reflects the serious nature of arbitrary file writes. Organizations with MoviePilot integrated into automated media workflows or those running it with elevated privileges should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L), requiring only low-level authentication (PR:L) and no user interaction (UI:N). The high impact on integrity (I:H) and availability (A:H) drives the severity classification, as successful exploitation allows overwriting arbitrary files and potentially rendering the application or system inoperable. The requirement for prior authentication prevents a score of 9.0 or higher, but the ease of exploitability and destructive potential justify the HIGH rating.

Frequently asked questions