CVE-2026-120320 Details
Description
A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.
A remote code execution vulnerability has been identified in jxxghp MoviePilot versions through 3.1.2. The issue arises in the Workflow Fork Endpoint, specifically within the WorkflowExecutor.restore_context function in app/chain/workflow.py. The vulnerability allows for unsafe deserialization of data, as the application decodes and unpickles content from the workflow context without proper validation or security checks. This flaw can be exploited by authenticated users with management permissions via the workflow fork API.
Users are advised to upgrade to MoviePilot version 3.1.3, which addresses the vulnerability by removing the legacy pickle deserialization and improving how workflow contexts are handled.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xGenesi/CVE/blob/main/MoviePilot_Workflow_Fork_Pickle_Deserialization_RCE.md | [email protected] | ExploitTechnical Analysis |
| https://github.com/jxxghp/MoviePilot/ | [email protected] | Vendor |
| https://github.com/jxxghp/MoviePilot/commit/6034dcc880c13079aeb398dbe32c346ebcd3a6d2 | [email protected] | Source CodeVendor |
| https://github.com/jxxghp/MoviePilot/pull/6930 | [email protected] | Issue TrackingVendor |
| https://github.com/jxxghp/MoviePilot/releases/tag/v3.1.3 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-120320 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1015025 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/429653 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/429653/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jxxghp MoviePilot | <= 3.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |