CVE-2026-11416 is a path traversal vulnerability (CWE-22) in the jxxghp MoviePilot application affecting its AliPan, U115, and Rclone cloud storage download handlers. The issue occurs because the local destination path for downloaded content is formed by concatenating the configured download directory with a filename taken directly from remote cloud API metadata. This filename is not sanitized via basename normalization or path validation, allowing an attacker who controls the remote cloud API filename to include directory traversal sequences ('../'). This can cause downloaded files to be written outside the intended directory, potentially overwriting arbitrary files such as configuration or plugin files accessible by the application process. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity, with network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

An attacker able to control filenames returned by the remote cloud storage API can exploit this vulnerability to write files outside the designated download directory. This can lead to overwriting arbitrary files accessible by the application process, including critical configuration or plugin files. The impact includes high integrity and availability damage to the affected system. There is no reported confidentiality impact. No known exploits in the wild have been reported at this time.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting or validating filenames returned by remote cloud APIs before use, or limit the privileges of the application process to minimize potential damage from file overwrites.