Live › vulnerability › CVE-2026-62362
Go to dashboardPeerBanHelper, a BitTorrent peer-blocking tool, passes an unsanitized field query parameter from its statistics analysis endpoint directly into SQL queries. An authenticated user can read all data in the PeerBanHelper database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running PeerBanHelper between versions 5.0.0 and 9.3.14 where users with a valid login can reach the statistics API. Exposure depends on who holds accounts on the instance; instances limited to a single trusted operator carry lower risk. Teams on 9.3.15 or later are not affected.
No product ranges from the sources yet.
9.3.15 are affected9.3.15Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so unrecognized field names are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation can read all data in the PeerBanHelper database. This issue is fixed in version 9.3.15.
This page as .md · .json · in your agent: get_signal("CVE-2026-62362")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.