CVE-2026-120320 in MoviePilot
Summary
by MITRE • 11/02/2026
A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in jxxghp MoviePilot versions up through 3.1.2 represents a critical security flaw within the application's workflow management subsystem, specifically targeting the Workflow Fork Endpoint functionality. This issue resides in the restore_context function located within the app/chain/workflow.py file of the software component responsible for handling workflow execution states. The core technical deficiency is rooted in insecure deserialization practices, where the system fails to adequately validate or sanitize input data before processing it as serialized objects. In many modern web applications and media management suites like MoviePilot, workflows are often used to automate complex sequences of tasks such as downloading, organizing, and tagging media files. When a workflow context is restored from stored state information, the application typically reconstructs Python objects based on this input. If an attacker can manipulate these serialized payloads, they bypass standard type checking mechanisms that would normally prevent arbitrary code execution or unauthorized system interactions.
This insecure deserialization vulnerability allows for remote exploitation by unauthenticated attackers who have network access to the MoviePilot service. The attack vector is particularly dangerous because it does not require user interaction beyond sending a crafted HTTP request containing maliciously serialized data. Once executed, this manipulation can lead to arbitrary code execution on the host system running the application. Given that media servers often run with elevated privileges or have broad file system access to manage large libraries of content, successful exploitation could result in complete compromise of the underlying operating system. The attacker may gain control over sensitive user data, install persistent backdoors, pivot into other network segments, or disrupt service availability through denial-of-service conditions triggered by malformed object instantiation.
The operational impact of this vulnerability is severe due to its remote nature and the public disclosure of exploit code. Publicly available exploits significantly lower the barrier to entry for malicious actors, increasing the likelihood of automated scanning and targeted attacks against exposed instances. Organizations or individuals running MoviePilot in internet-facing environments are at immediate risk. The ability to execute arbitrary commands means that an attacker can exfiltrate personal viewing habits, access connected storage devices containing private media, or use the compromised server as a launchpad for further cyber operations. This aligns with common attack patterns observed in real-world scenarios where application-layer vulnerabilities serve as initial entry points for broader infrastructure compromise.
From a classification perspective, this vulnerability maps directly to CWE-502, which describes Deserialization of Untrusted Data. It also correlates with MITRE ATT&CK techniques related to Command and Scripting Interpreter execution via remote services, specifically those involving object injection or serialization abuse. The lack of strict input validation on deserialized objects is a classic anti-pattern that security frameworks consistently flag as high-risk. Mitigation strategies must prioritize immediate remediation through software updates rather than relying solely on network-level controls, although defense-in-depth measures such as web application firewalls with specific rules for detecting serialized payload anomalies can provide temporary protection during the transition period.
The recommended course of action is to upgrade jxxghp MoviePilot to version 3.1.3 or later immediately upon availability. The patch associated with commit hash 6034dcc880c13079aeb398dbe32c346ebcd3a6d2 addresses the insecure deserialization flaw by implementing stricter validation checks and potentially replacing unsafe serialization methods with safer alternatives such as JSON-based state management or signed serialized objects. Administrators should verify their current version using standard application commands before initiating the upgrade process to ensure compatibility with existing configurations. After upgrading, it is advisable to review access logs for any signs of exploitation attempts prior to the patch deployment date, allowing security teams to assess potential damage and adjust monitoring thresholds accordingly. Regular maintenance schedules that include prompt application of vendor-released patches are essential to mitigate such risks in continuously running services like media servers.