EUVD-2026-40288
GHSA-5gfq-2rx4-6vwv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-delivered exploit requires no privileges; arbitrary file write is high Integrity impact; no Confidentiality or Availability impact described.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata.
Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny's child() does not collapse "..". A v2 file tree key, a v1 files[].path element, or a single-file name containing ".." segments therefore resolves outside the download directory.
Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.
AnalysisAI
Arbitrary file write in Net::BitTorrent 2.0.1 and earlier allows a malicious BitTorrent peer to place attacker-controlled content at attacker-chosen filesystem paths outside the designated download directory. The library validates path components on the .torrent ingest path but omits identical validation for peer-supplied metadata received via the BEP09 ut_metadata extension, causing file names containing '..' segments to resolve to traversal targets when passed to Storage::add_file. Because the attacking peer controls both the piece hashes and the served bytes, content verification passes silently, making the write invisible to the application. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Technical ContextAI
Net::BitTorrent (CPE: cpe:2.3:a:sanko:net::bittorrent:*:*:*:*:*:*:*:*) is a Perl implementation of the BitTorrent protocol. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): path component sanitization is applied only during .torrent file ingestion and is entirely absent from the peer metadata code path. The _on_metadata_received handler, reached via the BEP09 ut_metadata extension that underpins magnet link functionality, passes attacker-supplied file names directly to Storage::add_file and Storage::_parse_file_tree. These functions use Path::Tiny's child() method, which does not collapse '..' sequences, allowing traversal out of the configured download root. The flaw affects v2 file tree keys, v1 files[].path array elements, and single-file name fields alike. Since the BitTorrent protocol permits a peer to serve arbitrary piece data alongside advertised hashes, an attacker simultaneously provides the traversal path and the expected hash, causing the client's piece-verification step to succeed and the out-of-bounds write to complete without any error signal.
RemediationAI
Consult the vendor security advisory at https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-5wc6-r65f-62rr for the confirmed patched release version, which was not independently specified in the available data; upgrade to that version as the primary remediation. Until a patch is applied, restrict Net::BitTorrent deployments to trusted, controlled peer sets by avoiding public magnet links and disabling connections to unknown peers, which prevents the BEP09 ut_metadata path from receiving attacker-controlled metadata - note this eliminates magnet link functionality. If the library exposes configuration to disable the ut_metadata extension or BEP09 support, disabling it removes the vulnerable code path at the cost of magnet link compatibility. Operators should run the process under a dedicated low-privilege account confined to a chroot, container, or filesystem namespace where write access is restricted to the intended download directory; this does not prevent the traversal attempt but contains the impact to that directory boundary. Do not rely on piece-hash verification as a security control for path integrity, as the attacker controls both the hash values and the served bytes.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Denial of service in the Go standard library's net package (on Windows) allows remote attackers to crash applications by
The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today