CVE-2026-124582 Details
Description
A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The reported GitHub issue was closed with the label "not planned".
A path traversal vulnerability has been identified in WebTorrent versions through 2.8.5 and 3.0.21. The issue arises in the File Path Handler component, specifically within the getFileModtimes function in torrent.js. The vulnerability allows for manipulation of the file.path argument, leading to unauthorized access to files outside the intended directory. This can be exploited remotely, as the affected file.path values are derived from the .torrent metadata, which can be controlled by an attacker.
The vulnerability has been fixed in WebTorrent. Users should update to the latest version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/webtorrent/webtorrent/ | [email protected] | Vendor |
| https://github.com/webtorrent/webtorrent/issues/3012 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/webtorrent/webtorrent/pull/3046 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-124582 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1039255 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/432939 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/432939/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WebTorrent | <= 2.8.5 (semver) <= 3.0.21 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |