Movary
CVE-2026-23840
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is ?categoryDeleted=. Version 0.70.0 fixes the issue.
AnalysisAI
Movary has a second input validation vulnerability allowing authenticated users to write arbitrary files on the server, enabling code execution through web shell upload.
Technical ContextAI
A separate CWE-20 input validation flaw in Movary allows authenticated users to write files to arbitrary locations on the server, complementing the file read vulnerability in CVE-2026-23839.
RemediationAI
Update Movary. Implement strict file path validation and restrict write permissions.
Movary has a third input validation vulnerability that allows authenticated users to delete arbitrary files from the ser
Movary movie tracking application has an input validation flaw that allows authenticated users to read arbitrary files f
Privilege escalation in Movary (self-hosted movie tracking app) versions before 0.71.1 allows any authenticated user to
Authenticated users in Movary (self-hosted movie tracking web app) can escalate privileges to administrator via a missin
Server-Side Request Forgery in Movary movie tracking application allows authenticated users to probe internal networks a
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today