Description (CNA)
MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where the local destination path is constructed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata without basename normalization or path validation. An attacker who controls a filename returned by a remote cloud storage API can include traversal sequences ../ in the filename to cause downloaded content to be written outside the configured download directory, potentially overwriting arbitrary files including configuration or plugin files reachable by the application process.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| jxxghp / MoviePilot | affected 0 before 2.13.4 |
CWE
CWE-22
References
- https://github.com/jxxghp/MoviePilot
- https://github.com/jxxghp/MoviePilot/issues/5894
- https://github.com/jxxghp/MoviePilot/commit/a0b3800f6bf4857bf4f889a63d44350eb8380f28
ADP enrichment
No English description supplied.