MoviePilot CVE-2026-11416

Requires MoviePilot to be configured with at least one of the affected storage backends (AliPan, U115, Rclone, or SMB) and to download a file whose name is controlled by the attacker via that backend - meaning the attacker must either control a cloud storage account the victim's MoviePilot is syncing from, a shared folder/link the victim ingests, or be able to tamper with cloud API responses. Exploitation does not require interaction at the MoviePilot web UI, but it does require MoviePilot's download flow to be invoked against the malicious filename (e.g., automated subscription processing or a user-initiated download). Limits: instances that only use local/built-in storage or only pull from fully trusted private accounts are not realistically reachable; the writable scope is constrained to paths the MoviePilot process user can write to.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H scores 7.2 (High), reflecting network attack vector, low complexity, low privileges, no user interaction, and high integrity and availability impact with no confidentiality impact. However, real-world exploitability is constrained: the 'attacker' is not directly contacting MoviePilot but must control filenames returned by an upstream cloud storage API (AliPan/U115/Rclone/SMB), meaning either a compromised cloud account, a malicious shared folder the victim ingests, or a man-in-the-middle on the cloud API. EPSS and KEV data were not provided in the input. No public exploit identified at time of analysis. The PR:L assignment is debatable since the privilege required is over the remote storage account, not MoviePilot itself - defenders should treat this as 'low-volume but high-impact when triggered' rather than a mass-exploitation candidate. Risk is materially higher for instances pulling from shared/public cloud folders.

An attacker shares a malicious file via AliPan, 115 Cloud, or an Rclone-backed remote with a filename like ../../config/app.yaml and induces the victim's MoviePilot instance to download it (e.g., the victim subscribes to the shared folder or the attacker compromises an account MoviePilot is configured to sync). When MoviePilot's download handler concatenates the download directory with the attacker-supplied filename, the file is written outside the intended directory, overwriting MoviePilot's configuration or a plugin module. On the next plugin load or restart, attacker-controlled content is executed within the application process.