---
id: "CVE-2026-124582"
page: "https://infrastack.ai/live/CVE-2026-124582"
kind: "vulnerability"
aliases: ["CVE-2026-124582"]
title: "WebTorrent: file path handling lets remote peers traverse directories"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["javascript", "node", "package", "webtorrent"]
not_affected_if: ["does-not-use-webtorrent"]
published_at: "2026-11-09T09:16:59+00:00"
first_seen_at: "2026-11-09T09:25:32+00:00"
updated_at: "2026-11-09T09:26:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124582", "first_seen_at": "2026-11-09T09:25:32+00:00"}]
exploit_sources: []
---

# WebTorrent: file path handling lets remote peers traverse directories

Link for people: https://infrastack.ai/live/CVE-2026-124582 (this .md is for agents)

WebTorrent, a BitTorrent library for JavaScript, does not properly validate file paths in its getFileModtimes function in torrent.js. A remote attacker can supply a crafted file.path value to read or probe files outside the intended download directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls webtorrent`
- Look for `webtorrent` in package.json and lockfiles to see whether it is a direct or transitive dependency

## Timeline

- 2026-11-09T09:25:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124582

## From the sources

A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The reported GitHub issue was closed with the label "not planned".

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_