The flaw lies in the WorkflowExecutor.restore_context method of the Workflow Fork Endpoint in MoviePilot, which accepts user‑supplied data and deserializes it without proper validation. This deserialization use of Python’s pickle mechanism (CWE‑502) combined with unchecked input (CWE‑20) can allow an attacker to inject serialized objects that execute arbitrary code when processed by a server running the vulnerable version. The consequence is that an attacker who can reach the endpoint can achieve complete remote code execution on the host that runs MoviePilot, potentially compromising all data and services hosted there.

All installations of jxxghp MoviePilot up to version 3.1.2 are affected. The vulnerability is present in the workflow.py component of the Workflow Fork Endpoint. Upgrading to version 3.1.3, which includes commit 6034dcc880c13079aeb398dbe32c346ebcd3a6d2, removes the insecure deserialization path.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV, but it has been publicly disclosed on multiple platforms. The attack vector is remote, meaning that anyone able to reach the Workflow Fork Endpoint over the network can exploit it without additional privileges. Because the flaw relies on standard Python pickle deserialization, an attacker only needs to supply crafted payloads, which can be achieved with readily available tools. Overall, the risk is significant for exposed deployments, especially those that expose the endpoint to the internet or untrusted networks.