MoviePilot CVE-2026-120320

Exploitation requires access to the authenticated Workflow feature (CVSS PR:H in the supplied vector; at minimum an authenticated account). The concrete prerequisite is a workflow whose stored context contains the legacy format - a 'content' key holding a base64-encoded Python pickle - which pre-3.1.3 restore_context deserializes via pickle.loads; the fork endpoint additionally propagated an attacker-supplied 'context' field from shared/forked workflows into that stored context. Limiting factors: the attacker must hold valid credentials/privileges (not a default-unauthenticated path), the vulnerable code path is the deprecated Base64 Pickle legacy format, and exploitation depends on the crafted context being loaded by WorkflowExecutor. Post-patch, the legacy pickle branch is removed (empty context used) and fork ignores the shared context entirely.

This is a CWE-502 Python pickle deserialization flaw in MoviePilot's WorkflowExecutor.restore_context. The signals are mixed. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 5.1) describes a remotely reachable, low-complexity, no-interaction issue but requires high privileges and rates each impact as Low (VC:L/VI:L/VA:L). That impact rating is in tension with the actual mechanism: the source diff confirms restore_context ran base64.b64decode + pickle.loads on attacker-influenceable workflow context, and the added test uses a __reduce__ callback payload - the hallmark of arbitrary code execution, which normally warrants High impact rather than Low. No EPSS score and no CISA KEV entry are provided, so there is no evidence of active exploitation or a measured exploitation probability. A public PoC reference exists (0xGenesi write-up) but the input flags it as not verified as working exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with an authenticated-only vector and absence of active exploitation. Net: a genuine deserialization-to-code-execution bug gated behind authentication (PR:H/PR:L) in a niche self-hosted product - real and worth patching on the stated this-month cadence, but not an internet-wide emergency. Note the discrepancy: vendor impact metrics (Low) understate pickle RCE - verify impact independently.

An authenticated user supplies a workflow whose context carries a legacy base64-encoded pickle in the 'content' field (for example via the Workflow fork/share feature). When WorkflowExecutor initializes and calls restore_context, the pre-3.1.3 code deserializes that payload with pickle.loads, running the attacker's __reduce__ callback as code. A public PoC reference exists but is not verified as working exploit code.