CVE-2026-121546 Details
Description
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.
A path traversal vulnerability has been identified in ruTorrent versions prior to 5.3.20, specifically within the datadir plugin. This vulnerability allows authenticated users to escape the topDirectory jail because the function responsible for directory validation does not resolve symbolic links. Attackers can exploit this by submitting a datadir path that includes a symlink pointing to a location outside the top directory, leading to unauthorized relocation of torrent data to directories writable by the web server or rtorrent.
Users can update to ruTorrent version 5.3.20 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Novik/ruTorrent | [email protected] | ProductVendor |
| https://github.com/Novik/ruTorrent/blob/v5.3.19/php/settings.php#L526-L541 | [email protected] | Source CodeVendor |
| https://github.com/Novik/ruTorrent/blob/v5.3.19/plugins/datadir/action.php#L60 | [email protected] | Source CodeVendor |
| https://github.com/Novik/ruTorrent/commit/2059ff12464b2ce14fd0f53df8d6b19fb6b8a5eb | [email protected] | Source CodeVendor |
| https://github.com/Novik/ruTorrent/issues/3474 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/rutorrent-before-5.3.20-path-traversal-via-datadir-plugin-symlink-following | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ruTorrent | >= 0, < 5.3.20 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |