CVE-2026-11416: Jxxghp Moviepilot

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded content to be written outside the configured download directory, potentially overwriting arbitrary files including configuration or plugin files reachable by the application process.

Affected products

• Jxxghp Moviepilot: before 2.13.4 (fixed in 2.13.4)

Published 2026-06-05. Last modified 2026-07-23.