The Nelvana Files: How a Linux Injection Exposed Unreleased Animation History

In a RelicPress exclusive, an anonymous source has come forward to detail a past security vulnerability within nelnet.nelvana.com. The breach highlights how a simple configuration error exposed internal production archives and unreleased media from the legendary animation studio.

The Technical Breakdown

The entry point was a flaw in the main site's query handling that broke the standard login redirect. The source identified this as a Linux injection vulnerability.

Bypassing Filters: While the system attempted to "clean" spaces to prevent command execution, the source used the ${IFS:0:1} variable to represent spaces, allowing commands to run undetected.

Proof of Access: By executing commands like whoami, the source confirmed their presence in the system via error logs.

Session Hijacking: A log file was discovered containing active session tokens. This allowed for access to the site without needing login credentials.

Evidence of Access

The following images provided by the source confirm the extent of the breach, showing a direct look at the Nelnet internal database and production environments.

This image displays an internal web portal for Nelnet showing a "Material Type" breakdown for the series Max and Ruby, listing hundreds of internal assets including audition tapes, storyboards, and scripts.

This screenshot shows a 3D rigging environment in Autodesk Maya 2009 featuring a model of Pablo from The Backyardigans. The file path indicates the model was accessed directly from a workstation desktop.

Lost Media Recovered

The most significant find within the server’s paths was a collection of animation production files and unaired content.

Internal Tools: The server hosted copies of Toon Boom and Flash used by the company for production.

Unaired Pilots: A specific directory contained pilots for various shows, including several that never made it to air.

Backyardigans Discovery: Notably, the intro to the Backyardigans Nick Digital pilot was found within these files.

Internet Archive Verification: Further proof of access is evidenced by files archived on the Internet Archive, including a QuickTime movie of a Backyardigans project and a Flash source file for the series Dog Trace.

The System Shutdown

The vulnerability was eventually closed following an accidental disruption of the site's functions. In an attempt to keep sessions active, a command was run to disable the log out.pl file. This led to the file being deleted entirely, preventing any users from logging out. This anomaly alerted administrators, and the site was taken down shortly after.

The source estimates that approximately 7GB of data and 1,000 files were retrieved during the window of access.

The Powerpuff Pilot That Never Was: How a Sales Reel Became a "Leak"

In early 2025, a roughly 3.5-minute video clip from The CW's canceled live-action Powerpuff Girls project (titled Powerpuff) went viral online. Shared across social media, Reddit, and lost media communities, it was widely described as a "leaked trailer" from a never-produced pilot. The clip featured an edgier, adult-oriented take on Blossom, Bubbles, and Buttercup, complete with jokes and effects that sparked widespread discussion and backlash. Many outlets reported it as footage from a 2021 pilot shoot that had mysteriously surfaced four years later, with the upload quickly gaining millions of views before facing copyright takedowns from Warner Bros.

This widespread narrative is incorrect. The video is not from a secret internal leak or an unauthorized release of a completed pilot. It is an "Upfront" sales presentation piece created for advertisers , and its online appearance stems from a standard portfolio posting by visual effects artist Brian Oliver, who was the Executive Director of Animation at The CW during its production.

What the Footage Actually Is

The piece was an Upfront promo, a sales tool used by networks to pitch programming blocks to advertisers for the fall season. It was assembled in post-production using "principal photography dailies" from an early pilot shoot.

If an actual completed pilot did exist, Brian Oliver was not aware of it, having never seen one during his tenure. To the best of his knowledge, the Upfront presentation was constructed entirely from existing footage provided by the creative and editorial teams, with nothing shot specifically for the promo itself.