{"id":"CVE-2026-124582","kind":"vulnerability","aliases":["CVE-2026-124582"],"related":[],"title":"WebTorrent: file path handling lets remote peers traverse directories","description":"A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The reported GitHub issue was closed with the label \"not planned\".","summary":"WebTorrent, a BitTorrent library for JavaScript, does not properly validate file paths in its getFileModtimes function in torrent.js. A remote attacker can supply a crafted file.path value to read or probe files outside the intended download directory.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node","package","webtorrent"],"not_affected_if":["does-not-use-webtorrent"],"how_to_check":"- Check the installed version with `npm ls webtorrent`\n- Look for `webtorrent` in package.json and lockfiles to see whether it is a direct or transitive dependency","fix":null,"status":"open","published_at":"2026-11-09T09:16:59+00:00","first_seen_at":"2026-11-09T09:25:32+00:00","triaged_at":"2026-11-09T09:26:17+00:00","updated_at":"2026-11-09T09:26:17+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T09:26:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WebTorrent: file path handling lets remote peers traverse directories","impact":"medium","summary":"WebTorrent, a BitTorrent library for JavaScript, does not properly validate file paths in its getFileModtimes function in torrent.js. A remote attacker can supply a crafted file.path value to read or probe files outside the intended download directory.","audience":"developers","category":"package","nicknames":[],"who_cares":["webtorrent","node","javascript"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote peers read or write files outside the download directory","analyst_note":"Confirm the fixed version and whether the upstream issue was resolved, since the GitHub issue was closed as not planned; check the NVD entry and the WebTorrent repository.","how_to_check":"- Check the installed version with `npm ls webtorrent`\n- Look for `webtorrent` in package.json and lockfiles to see whether it is a direct or transitive dependency","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["does-not-use-webtorrent"],"who_is_affected":"Applications that use WebTorrent in Node.js or the browser to download torrent content to disk and handle file paths from torrent metadata. The sources list versions up to 2.8.5 and 3.0.21 as affected, but do not state a fixed version. Projects that do not use WebTorrent can skip this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4581,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124582':12A,15A '-2026':11A,14A '/3.0.21':66C '2.8.5':65C 'affect':67C 'argument':89C 'attack':40B,96C 'avail':106C 'bittorr':22B 'close':116C 'compon':81C 'craft':44B 'cve':10A,13A 'directori':9A,56B 'download':55B 'exploit':103C 'file':2A,30B,51B,77C,82C 'file.path':45B,90C 'function':35B,73C 'getfilemodtim':34B,74C 'github':113C 'handl':4A 'handler':84C 'identifi':60C 'intend':54B 'issu':114C 'javascript':16B,25B 'label':119C 'lead':91C 'let':5A 'librari':23B 'manipul':86C 'may':97C 'might':108C 'node':17B 'outsid':52B 'packag':18B 'path':3A,31B,83C,93C 'peer':7A 'perform':99C 'plan':121C 'probe':50B 'proper':28B 'public':105C 'read':48B 'remot':6A,39B,101C 'report':112C 'suppli':42B 'torrent.js':37B,78C 'travers':8A,94C 'use':110C 'valid':29B 'valu':46B 'vulner':58C,70C 'webtorr':1A,19B,20B,62C","nicknames":[],"mitigations":[],"who_affected":"Applications that use WebTorrent in Node.js or the browser to download torrent content to disk and handle file paths from torrent metadata. The sources list versions up to 2.8.5 and 3.0.21 as affected, but do not state a fixed version. Projects that do not use WebTorrent can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["javascript","medium","node","package","webtorrent"],"campaign_type":null,"search_a":"'-124582':12A,15A '-2026':11A,14A 'cve':10A,13A 'directori':9A 'file':2A 'handl':4A 'let':5A 'path':3A 'peer':7A 'remot':6A 'travers':8A 'webtorr':1A","search_b":"'attack':40B 'bittorr':22B 'craft':44B 'directori':56B 'download':55B 'file':30B,51B 'file.path':45B 'function':35B 'getfilemodtim':34B 'intend':54B 'javascript':16B,25B 'librari':23B 'node':17B 'outsid':52B 'packag':18B 'path':31B 'probe':50B 'proper':28B 'read':48B 'remot':39B 'suppli':42B 'torrent.js':37B 'valid':29B 'valu':46B 'webtorr':19B,20B","search_c":"'/3.0.21':66C '2.8.5':65C 'affect':67C 'argument':89C 'attack':96C 'avail':106C 'close':116C 'compon':81C 'exploit':103C 'file':77C,82C 'file.path':90C 'function':73C 'getfilemodtim':74C 'github':113C 'handler':84C 'identifi':60C 'issu':114C 'label':119C 'lead':91C 'manipul':86C 'may':97C 'might':108C 'path':83C,93C 'perform':99C 'plan':121C 'public':105C 'remot':101C 'report':112C 'torrent.js':78C 'travers':94C 'use':110C 'vulner':58C,70C 'webtorr':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T09:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124582","severity":null,"published_at":"2026-11-09T09:16:59+00:00","modified_at":"2026-11-09T09:16:59+00:00","first_seen_at":"2026-11-09T09:25:32+00:00","fetched_at":"2026-11-09T09:25:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}