ruTorrent EUVD-2026-115891

Requires a valid authenticated ruTorrent account (PR:L) with access to the datadir plugin, plus the ability to create a symbolic link within the attacker's assigned topDirectory that resolves to a path outside it; the attacker then submits a datadir value traversing that link. What LIMITS exploitation: authentication is mandatory (not remote-unauthenticated), the datadir plugin must be in use, the attacker must be able to place a symlink under their top directory (the AT:P attack requirement), and meaningful impact depends on sensitive destinations (e.g. web root) being writable by the web server or rtorrent. Exploitation does not require victim user interaction (UI:N).

This is a moderate-severity, authenticated integrity flaw rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) tells a consistent story with the description: exploitation is network-reachable through the ruTorrent web UI but requires an already-authenticated low-privileged account (PR:L) and a specific precondition - the attacker must plant a symlink under their own top directory (AT:P reflects this attack requirement). Impact is skewed to integrity (VI:H) - creating directories and moving torrent data into locations writable by the web server or rtorrent - with no confidentiality loss (VC:N) and only limited availability impact (VA:L). The vuln.today decision label is 'this_month', not act_now/emergency, and no EPSS score, CISA KEV listing, or confirmed exploit code was provided, so there is no signal of active exploitation or mass automated attack. The realistic risk is a post-authentication primitive (arbitrary directory creation / file placement in web-writable paths) that could be chained toward code execution if the web root or other sensitive directories are writable - meaningful for multi-user/seedbox deployments but gated behind valid credentials. EPSS and KEV data are absent (not low - simply not provided), so prioritization rests on the this_month decision label, confirmed vendor patch, and the authenticated-only requirement.

A low-privileged but authenticated ruTorrent user creates a symbolic link inside their assigned top directory that points to a location outside the jail (e.g. a web-server-writable path), then uses the datadir plugin's 'set data directory' action to submit a datadir path that traverses that symlink. Because correctDirectory() validated the path only as written and the subsequent mkdir/rename/copy operations follow links, the download's files and new directories are created outside the intended jail. No public exploit was identified at time of analysis, and attack requires the attacker to control a symlink under their top directory (AT:P).