---
id: "CVE-2026-121546"
kind: "vulnerability"
aliases: ["CVE-2026-121546"]
title: "ruTorrent: datadir plugin path traversal lets users escape their directory jail"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "rutorrent", "self-hosted", "torrent-seedbox"]
not_affected_if: ["datadir-plugin-disabled", "no-untrusted-accounts", "single-user-install"]
published_at: "2026-11-03T16:17:26+00:00"
first_seen_at: "2026-11-03T16:21:43+00:00"
updated_at: "2026-11-03T16:24:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121546", "first_seen_at": "2026-11-03T16:21:43+00:00"}]
---

# ruTorrent: datadir plugin path traversal lets users escape their directory jail

ruTorrent's datadir plugin does not resolve symbolic links when checking directory paths, so a logged-in user can point a torrent's data directory through a symlink outside their allowed folder. An attacker can then create directories and move torrent data into locations the web server or rtorrent can write to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ruTorrent version and whether it is below `5.3.20`.
- Look for the datadir plugin being enabled in the ruTorrent plugin configuration.

## Fix

- Upgrade ruTorrent to `5.3.20` or later.

## Timeline

- 2026-11-03T16:21:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121546

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/rutorrent-before-5.3.20-path-traversal-via-datadir-plugin-symlink-following
- [fix] Patch: github.com https://github.com/Novik/ruTorrent/commit/2059ff12464b2ce14fd0f53df8d6b19fb6b8a5eb

## From the sources

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_