Movary
CVE-2026-23839
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is ?categoryUpdated=. Version 0.70.0 fixes the issue.
AnalysisAI
Movary movie tracking application has an input validation flaw that allows authenticated users to read arbitrary files from the server, potentially exposing configuration files and secrets.
Technical ContextAI
Movary lacks proper input validation (CWE-20) on file path parameters, allowing authenticated users to traverse the directory structure and read arbitrary files from the server filesystem.
RemediationAI
Update Movary. Validate and sanitize all file path inputs. Restrict file access to the application directory.
Movary has a third input validation vulnerability that allows authenticated users to delete arbitrary files from the ser
Movary has a second input validation vulnerability allowing authenticated users to write arbitrary files on the server,
Privilege escalation in Movary (self-hosted movie tracking app) versions before 0.71.1 allows any authenticated user to
Authenticated users in Movary (self-hosted movie tracking web app) can escalate privileges to administrator via a missin
Server-Side Request Forgery in Movary movie tracking application allows authenticated users to probe internal networks a
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today