CVE-2026-124582
Deferred
Deferred - Pending Action
Path Traversal in WebTorrent via Malicious File Path
Vulnerability report for CVE-2026-124582, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-09
Last updated on: 2026-11-09
Assigner: VulDB
Description
Description
A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The reported GitHub issue was closed with the label "not planned".
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n/a | WebTorrent | 2.8.0 |
| n/a | WebTorrent | 2.8.1 |
| n/a | WebTorrent | 2.8.2 |
| n/a | WebTorrent | 2.8.3 |
| n/a | WebTorrent | 2.8.4 |
| n/a | WebTorrent | 2.8.5 |
| n/a | WebTorrent | 3.0.0 |
| n/a | WebTorrent | 3.0.1 |
| n/a | WebTorrent | 3.0.2 |
| n/a | WebTorrent | 3.0.3 |
| n/a | WebTorrent | 3.0.4 |
| n/a | WebTorrent | 3.0.5 |
| n/a | WebTorrent | 3.0.6 |
| n/a | WebTorrent | 3.0.7 |
| n/a | WebTorrent | 3.0.8 |
| n/a | WebTorrent | 3.0.9 |
| n/a | WebTorrent | 3.0.10 |
| n/a | WebTorrent | 3.0.11 |
| n/a | WebTorrent | 3.0.12 |
| n/a | WebTorrent | 3.0.13 |
| n/a | WebTorrent | 3.0.14 |
| n/a | WebTorrent | 3.0.15 |
| n/a | WebTorrent | 3.0.16 |
| n/a | WebTorrent | 3.0.17 |
| n/a | WebTorrent | 3.0.18 |
| n/a | WebTorrent | 3.0.19 |
| n/a | WebTorrent | 3.0.20 |
| n/a | WebTorrent | 3.0.21 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
