Executive Summary

This vulnerability is a path traversal issue in MoviePilot's AliPan, U115, and Rclone cloud storage download handlers. The problem arises because the local destination path for downloaded files is created by simply joining the configured download directory with a filename obtained directly from remote cloud API metadata. There is no normalization or validation of the filename to remove or block traversal sequences like "../".

An attacker who can control the filename returned by the remote cloud storage API can exploit this by including traversal sequences in the filename. This causes the downloaded content to be saved outside the intended download directory, potentially overwriting arbitrary files on the system, including important configuration or plugin files accessible by the application.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts because it allows an attacker to write files outside the designated download directory. This can lead to overwriting critical files such as configuration or plugin files used by the application.

• Potential unauthorized modification or corruption of application files.
• Possible disruption of application functionality or stability.
• Increased risk of further exploitation if critical files are overwritten.

Useful 0 Not Useful 0