MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers. The application concatenates the configured download directory with a filename obtained directly from remote cloud API metadata, without performing basename normalization or path validation. An attacker who can influence the filename returned by the cloud API can embed traversal sequences such as "../", causing the downloaded content to be written outside the intended directory. This flaw permits the overwriting of arbitrary files that are writable by the MoviePilot process, including configuration files and plugin files, and thereby disrupts the application or modifies its behaviour.

The affected product is MoviePilot developed by jxxghp. All releases that include the AliPan, U115, and Rclone download handlers are vulnerable; a specific version range is not provided, so the issue applies to the current stable version and any prior releases that did not incorporate the patch.

The CVSS score of 7.2 indicates high severity, reflecting the potential to compromise application integrity. The EPSS score is not available, leaving the exact likelihood of exploitation uncertain, but the ability to overwrite arbitrary files is a significant concern. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remotely controllable through the cloud storage interface, with no requirement for local privileged access. Based on the description, it is inferred that overwriting critical files could enable code execution if the replaced files are executed or trigger plugin reloads, although this outcome is not explicitly confirmed by the advisory.