Path Traversal Vulnerability in Net::BitTorrent by Sanko
CVE-2026-57079

5.3MEDIUM

Key Information:

Vendor

Sanko

Status
Net::bittorrent
Vendor
CVE Published:
30 June 2026

What is CVE-2026-57079?

The vulnerability in Net::BitTorrent permits attackers to execute path traversal attacks, enabling the writing of files outside the designated download directory. This arises due to insufficient validation of peer-supplied metadata during the handling of torrent file ingest. Specifically, attackers can utilize crafted metadata paths that include '..' segments, thereby targeting arbitrary file systems and placing malicious content at chosen locations on the host. This risk underscores the necessity for enhanced validation mechanisms in handling incoming file paths to safeguard against unauthorized file access and potential data compromise.

Affected Version(s)

Net::BitTorrent 0 <= 2.0.1

References

https://github.com/sanko/Net-BitTorrent.pm/security/advis...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.