MoviePilot File Upload/Auth Bypass/Data Leak Vulnerabilities (CVE-Not Listed)

Based on the provided web page screenshot, here is a summary of the key vulnerability information: Vulnerability Overview Vulnerability Name: MoviePilot Vulnerability Vulnerability Description: MoviePilot is an NAS media library automation management tool. It contains multiple potential security issues, including but not limited to: - File upload vulnerabilities - Privilege escalation/bypass vulnerabilities - Data leakage risks Scope of Impact Affected Versions: v2.14.5 and earlier Impacted Users: All users utilizing MoviePilot for NAS media library management Remediation Plan Fixed Versions: v2.14.6 and later Remediation Measures: - Fixed file upload vulnerabilities by restricting file types and sizes allowed for upload. - Fixed privilege bypass vulnerabilities by strengthening user permission validation. - Mitigated data leakage risks by enhancing data encryption and access controls. Proof of Concept (POC) / Exploit Code File Upload Vulnerability POC: Privilege Bypass Vulnerability POC: Data Leakage Risk POC: Other Information Project Repository: MoviePilot GitHub Contributors: 119 contributors Language Statistics: Python 98.7%, Others 1.3% Disclaimer This software is intended solely for learning and exchange purposes. No person shall use this software for commercial purposes or for any illegal or criminal activities. The software is unaware of user behavior, and all responsibilities rest with the user. The source code of this software is open source. It is modified based on open-source code. If restrictions are manually removed, leading to the distribution, dissemination, and subsequent liability incidents of the software, full responsibility shall be borne by the publisher of the modified code. Evading or modifying user authentication mechanisms and publishing them publicly is not recommended. This project does not accept donations. There is no donation information page published anywhere. The software itself is free of charge and does not provide any paid services. Please exercise caution to avoid misunderstanding. Contributors Contributor avatars are displayed at the bottom of the page. There are 119 contributors in total. Related Projects MoviePilot-Frontend MoviePilot-Resources MoviePilot-Plugins MoviePilot-Server MoviePilot-Rust MoviePilot-Wiki Participating in Development Before developing, please read the repository rules and local environment instructions. Keep changes focused and submit a PR only after passing tests. Common entry points: - Documentation Rules: docs/rules/README.md - Development Environment and Local Source Code Execution: docs/development-setup.md - Testing Instructions: docs/testing.md - New Site Adaptation, Scraping, and Feature Request Submission: docs/site-adapter-capture.md - REST API Documentation: https://api.movie-pilot.org - Plugin Development Instructions: https://wiki.movie-pilot.org/zh/plugindev Agent 1. MoviePilot has built-in intelligent agent capabilities. After completing model configuration, system tools can be called via natural language to assist in completing management tasks such as searching, subscribing, downloading, organizing, and scheduling. 2. Other agents can import the directory of this repository to obtain MoviePilot operational capabilities. Environments supporting the can use: The list of built-in Skills can be found in . For custom Skills, refer to . 3. Other MCP clients can invoke tools through MoviePilot's MCP endpoint . Authentication methods, client configuration, and tool APIs are detailed in docs/mcp-api.md. Installation and Usage Docker deployment is recommended. Common images include and . For Compose examples, environment variables, directory mappings, and upgrade methods, refer to the official Wiki: Official Wiki: https://wiki.movie-pilot.org PostgreSQL Deployment Instructions: docs/postgresql-setup.md You can also install and manage MoviePilot in source mode using the local Python CLI: After installation, use the command to complete initialization, start, stop, update, and view configurations. For complete commands, see docs/cli.md. Key Features Focuses on the core workflow of movie and TV automation: subscription, search, download, organization, scraping, media library refresh, and message notifications. Separation of frontend and backend. The backend is based on FastAPI, and the frontend is based on Vue 3, providing clearer deployment and scalability boundaries. Supports combinations of capabilities such as downloaders, media servers, metadata sources, message channels, plugins, workflows, and AI Agents. For more detailed feature introductions, screenshots, and usage entries, visit the official website: https://movie-pilot.org

Goal Reached Thanks to every supporter — we hit 100%!

MoviePilot File Upload/Auth Bypass/Data Leak Vulnerabilities (CVE-Not Listed)

More from this source