CVE-2026-11416: MoviePilot Path Traversal via Cloud Storage Download Handlers
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded content to be written outside the configured download directory, potentially overwriting arbitrary files including configuration or plugin files reachable by the application process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not concatenate raw filenames from remote cloud metadata into local paths. Canonicalize incoming filenames (e.g., use basename or equivalent), strip or reject any path separators or traversal sequences (../), and ensure the resolved path remains inside the configured download directory before writing.
MoviePilot (AliPan, U115, Rclone cloud storage download handlers) filename handling / path validation = basename-normalize and validate filenames; disallow path separators and traversal sequences - Configuration
When possible, ignore remote-provided filenames and generate safe local filenames (for example, use a sanitized token or UUID plus a validated extension) to avoid relying on untrusted metadata.
MoviePilot (download pipeline) local filename policy = generate safe local filenames instead of using remote-provided names - Compensating control
Restrict filesystem and process privileges: run the MoviePilot process with least privilege, ensure the configured download directory is owned by a dedicated low-privilege user, and apply OS-level filesystem permissions so the process cannot write to sensitive configuration or plugin locations outside the download directory.
- Operational
Audit and remediate: scan for and review any files that may have been written or modified outside the download directory (especially configuration and plugin files), restore affected files from known-good backups, and rotate credentials/secrets if their integrity may have been impacted.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11416?
CVE-2026-11416 has a severity rating of high with a score of 8.1.
What vulnerabilities are associated with CVE-2026-11416?
CVE-2026-11416 involves a path traversal vulnerability in the MoviePilot cloud storage download handlers.
How do I fix CVE-2026-11416?
To fix CVE-2026-11416, ensure proper validation and sanitization of file paths before using them in download handlers.
What impact does CVE-2026-11416 have on MoviePilot users?
CVE-2026-11416 could allow attackers to access sensitive files on the local system by exploiting the path traversal vulnerability.
Is CVE-2026-11416 a common vulnerability in cloud storage applications?
While path traversal vulnerabilities can occur in various applications, CVE-2026-11416 specifically affects MoviePilot's implementation.