Moviepilot
Monthly
Arbitrary OS command execution on hosts running MoviePilot through 3.1.5 is achievable when the product's LLM agent ingests attacker-controlled content via browse_webpage, search_web, or torrent metadata parsing and is induced to call the unrestricted ExecuteCommandTool, which runs shell commands through asyncio.create_subprocess_shell under the admin session's is_admin context. The flaw is a prompt-injection-to-RCE chain (CWE-1427) that bypasses the validate_command_safety denylist by setting confirm_dangerous=true; the attacker needs no MoviePilot credentials (CVSS PR:N), but an administrator must interact with the poisoned content (UI:P in CVSS:4.0, UI:R in the assessed CVSS:3.1) and the model must be successfully coerced, so the issue is conditionally gated rather than a mass-exploitation emergency. Severity is 8.7 in CVSS:4.0 and 8.7 in the independently assessed CVSS:3.1; no public exploit code and no CISA KEV entry are associated as of this analysis.
Path traversal in MoviePilot's AliPan, U115, Rclone, and SMB cloud storage download handlers allows an attacker who controls remote filenames to write files outside the configured download directory. The flaw stems from unsanitized concatenation of filenames returned by remote cloud APIs, enabling overwrite of configuration files, plugins, or other files accessible to the application process. No public exploit identified at time of analysis, but a vendor patch is available via upstream commit a0b3800.
Server-side request forgery in MoviePilot v2's image proxy endpoint (/api/v1/system/img-proxy) allows authenticated attackers holding a valid resource_token cookie to coerce the server into fetching arbitrary internal URLs. The flaw stems from SecurityUtils.is_safe_url performing domain-membership checks without blocking private, loopback, or link-local IPs, letting attackers enumerate co-hosted media services such as Jellyfin, Emby, and Plex and exfiltrate internal data. No public exploit identified at time of analysis, though the upstream patch and vendor-published advisory clearly document the attack path.
MoviePilot through 3.1.2 deserializes untrusted Python pickle data when restoring saved workflow execution context, and the workflow fork endpoint copied an attacker-supplied 'context' field from shared workflow payloads straight into that stored context, so a crafted shared workflow can trigger code execution on the instance that forks or later runs it. Exploitation requires an authenticated account with access to the Workflow feature (CVSS 4.0 PR:H in the supplied vector; the independently assessed 3.1 vector scores PR:L) and depends on the legacy Base64 pickle 'content' format being loaded by WorkflowExecutor.restore_context. A public PoC reference exists; it is not verified as working exploit code, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has fixed the issue in 3.1.3.
Improper authorization across multiple dashboard API endpoints in MoviePilot through version 2.13.5 allows any authenticated low-privilege user to access administrative telemetry that should be restricted to superusers. The root cause, confirmed by patch commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900, is that route handlers in `app/api/endpoints/dashboard.py` used `verify_token` (any valid session) rather than `get_current_active_superuser` for endpoints exposing system stats, storage, CPU/memory usage, downloader metrics, and scheduler information. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Arbitrary OS command execution on hosts running MoviePilot through 3.1.5 is achievable when the product's LLM agent ingests attacker-controlled content via browse_webpage, search_web, or torrent metadata parsing and is induced to call the unrestricted ExecuteCommandTool, which runs shell commands through asyncio.create_subprocess_shell under the admin session's is_admin context. The flaw is a prompt-injection-to-RCE chain (CWE-1427) that bypasses the validate_command_safety denylist by setting confirm_dangerous=true; the attacker needs no MoviePilot credentials (CVSS PR:N), but an administrator must interact with the poisoned content (UI:P in CVSS:4.0, UI:R in the assessed CVSS:3.1) and the model must be successfully coerced, so the issue is conditionally gated rather than a mass-exploitation emergency. Severity is 8.7 in CVSS:4.0 and 8.7 in the independently assessed CVSS:3.1; no public exploit code and no CISA KEV entry are associated as of this analysis.
Path traversal in MoviePilot's AliPan, U115, Rclone, and SMB cloud storage download handlers allows an attacker who controls remote filenames to write files outside the configured download directory. The flaw stems from unsanitized concatenation of filenames returned by remote cloud APIs, enabling overwrite of configuration files, plugins, or other files accessible to the application process. No public exploit identified at time of analysis, but a vendor patch is available via upstream commit a0b3800.
Server-side request forgery in MoviePilot v2's image proxy endpoint (/api/v1/system/img-proxy) allows authenticated attackers holding a valid resource_token cookie to coerce the server into fetching arbitrary internal URLs. The flaw stems from SecurityUtils.is_safe_url performing domain-membership checks without blocking private, loopback, or link-local IPs, letting attackers enumerate co-hosted media services such as Jellyfin, Emby, and Plex and exfiltrate internal data. No public exploit identified at time of analysis, though the upstream patch and vendor-published advisory clearly document the attack path.
MoviePilot through 3.1.2 deserializes untrusted Python pickle data when restoring saved workflow execution context, and the workflow fork endpoint copied an attacker-supplied 'context' field from shared workflow payloads straight into that stored context, so a crafted shared workflow can trigger code execution on the instance that forks or later runs it. Exploitation requires an authenticated account with access to the Workflow feature (CVSS 4.0 PR:H in the supplied vector; the independently assessed 3.1 vector scores PR:L) and depends on the legacy Base64 pickle 'content' format being loaded by WorkflowExecutor.restore_context. A public PoC reference exists; it is not verified as working exploit code, no confirmed active exploitation (CISA KEV) has been reported, and the vendor has fixed the issue in 3.1.3.
Improper authorization across multiple dashboard API endpoints in MoviePilot through version 2.13.5 allows any authenticated low-privilege user to access administrative telemetry that should be restricted to superusers. The root cause, confirmed by patch commit dc2b6910a423b3bfadeffaa303e1ba75cfb33900, is that route handlers in `app/api/endpoints/dashboard.py` used `verify_token` (any valid session) rather than `get_current_active_superuser` for endpoints exposing system stats, storage, CPU/memory usage, downloader metrics, and scheduler information. No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.