Net::BitTorrent CVE-2026-57079

The victim must be running an application built on Net::BitTorrent 2.0.1 or earlier and must initiate a download that results in a peer connection to the attacker's node - either by opening a crafted magnet link or by the client peering with a malicious node in a shared swarm. The BEP09 ut_metadata extension, which is standard for magnet link operation and not a non-default feature, is the entry point; no special library configuration is needed to reach the vulnerable code path. Once the peer connection is established, exploitation proceeds automatically without further user interaction. The attacker must control at least one BitTorrent peer that the victim's client connects to, and must supply '..' path components in the metadata file list along with matching piece hashes for the chosen payload. Exploitation is bounded by the OS-level filesystem permissions of the process running Net::BitTorrent - the attacker cannot write to paths the process cannot write to - but no elevated privileges within the application are required.

The official NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) contains a significant metric conflict with the vulnerability description: the vector assigns C:L (Confidentiality: Low) and I:N (Integrity: None), yet the described impact is unambiguously an arbitrary file write - an Integrity violation with no described Confidentiality impact. This inversion appears to be an error in the submitted vector; security teams should not use the official score as the basis for prioritization without verifying against the vendor advisory. An independent assessment placing I:H yields a score in the High range (approximately 7.5), which better reflects the real-world consequence of writing attacker-controlled content to sensitive paths. No EPSS data was provided. The vulnerability is not listed in CISA KEV and no public exploit code was identified. Real-world risk is moderated by the library's niche deployment footprint - Net::BitTorrent is a specialist Perl library, not a widely deployed enterprise component - but the intrinsic primitives available to an attacker (arbitrary content, arbitrary path, silent verification pass) are severe and can chain to code execution if the process has write access to paths such as cron directories, SSH authorized_keys, or shell initialization files.

An attacker deploys a malicious BitTorrent peer and distributes a crafted magnet link via a forum, email, or torrent index site. When a victim's Perl application using Net::BitTorrent opens the magnet link and connects to the attacker's peer, the peer advertises BEP09 ut_metadata containing a files[].path entry such as ['..', '..', '.ssh', 'authorized_keys'] and simultaneously serves piece data - a crafted SSH public key - with matching hashes. Net::BitTorrent resolves the traversal path via Path::Tiny child(), writes the SSH key to ~/.ssh/authorized_keys, passes piece verification, and returns no error, granting the attacker SSH access to the host under the identity of the process owner.