Live › vulnerability › CVE-2026-121546
ruTorrent's datadir plugin does not resolve symbolic links when checking directory paths, so a logged-in user can point a torrent's data directory through a symlink outside their allowed folder. An attacker can then create directories and move torrent data into locations the web server or rtorrent can write to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Teams that run ruTorrent with multiple users who have accounts and a topDirectory restriction, where the datadir plugin is in use. Single-user installs where only trusted people have logins carry less risk. The sources do not say whether the plugin is enabled by default.
No product ranges from the sources yet.
5.3.20.5.3.20 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.
This page as .md · .json · in your agent: get_signal("CVE-2026-121546")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.