Movary
CVE-2026-23841
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Movary is a web application to track, rate and explore your movie watch history. Due to insufficient input validation, attackers can trigger cross-site scripting payloads in versions prior to 0.70.0. The vulnerable parameter is ?categoryCreated=. Version 0.70.0 fixes the issue.
AnalysisAI
Movary has a third input validation vulnerability that allows authenticated users to delete arbitrary files from the server, potentially causing data loss or service disruption.
Technical ContextAI
A third CWE-20 vulnerability in Movary allows authenticated users to delete arbitrary files on the server by manipulating file path parameters. Combined with CVE-2026-23839 (read) and CVE-2026-23840 (write), this completes a full file system manipulation chain.
RemediationAI
Update Movary to address all three file manipulation vulnerabilities.
Movary has a second input validation vulnerability allowing authenticated users to write arbitrary files on the server,
Movary movie tracking application has an input validation flaw that allows authenticated users to read arbitrary files f
Privilege escalation in Movary (self-hosted movie tracking app) versions before 0.71.1 allows any authenticated user to
Authenticated users in Movary (self-hosted movie tracking web app) can escalate privileges to administrator via a missin
Server-Side Request Forgery in Movary movie tracking application allows authenticated users to probe internal networks a
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today