CVE-2026-121546
Deferred Deferred - Pending Action

Path Traversal in ruTorrent via Datadir Plugin

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121546
EUVD
EUVD-2026-115891

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Novik ruTorrent 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in ruTorrent versions before 5.3.20. It exists in the datadir plugin where the correctDirectory() function fails to resolve symbolic links properly. Authenticated users can escape the topDirectory jail by submitting a datadir path through a symlink under their top directory. This allows creating directories and moving torrent data to locations writable by the web server or rtorrent, bypassing intended restrictions.

Detection Guidance

Check ruTorrent version with 'grep -r "version" /path/to/rutorrent/php/settings.php' or 'curl -s http://your-server/rutorrent/php/settings.php | grep version'. If version is below 5.3.20, the system is vulnerable. Inspect plugins/datadir/action.php for improper input validation in the 'datadir' parameter handling.

Impact Analysis

An attacker could move torrent data to arbitrary filesystem locations outside the configured topDirectory. This may allow unauthorized file access, modification, or execution on the server. In multi-tenant environments, it enables low-privileged users to escape their storage space and potentially compromise other users' data or the entire system.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating confidentiality requirements in GDPR and HIPAA. It undermines data isolation in multi-tenant environments, potentially causing non-compliance with access control and data protection provisions. Organizations using affected versions may face compliance violations and regulatory penalties.

Mitigation Strategies

Upgrade ruTorrent to version 5.3.20 or later immediately. If upgrading is not possible, disable the datadir plugin by removing or renaming the plugins/datadir directory. Ensure the web server process has minimal filesystem permissions and restrict access to rTorrent's directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121546. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...