Rutorrent
Monthly
Path traversal in the datadir plugin of ruTorrent before 5.3.20 lets an authenticated user escape the configured topDirectory jail and have the web server create directories and move torrent data to locations outside it. The root cause is that correctDirectory() compares the submitted datadir as written and does not resolve symbolic links, while the downstream mkdir/rename/copy operations do follow them; an attacker who can place a symlink under their own top directory and then submit a datadir path through it can redirect torrent data to any path writable by the web server or rtorrent, such as the web root. Exploitation requires a valid ruTorrent account with datadir plugin access and the ability to create that symlink; no public exploit code was identified at time of analysis, and the vendor fix is in 5.3.20.
Path traversal in the datadir plugin of ruTorrent before 5.3.20 lets an authenticated user escape the configured topDirectory jail and have the web server create directories and move torrent data to locations outside it. The root cause is that correctDirectory() compares the submitted datadir as written and does not resolve symbolic links, while the downstream mkdir/rename/copy operations do follow them; an attacker who can place a symlink under their own top directory and then submit a datadir path through it can redirect torrent data to any path writable by the web server or rtorrent, such as the web root. Exploitation requires a valid ruTorrent account with datadir plugin access and the ability to create that symlink; no public exploit code was identified at time of analysis, and the vendor fix is in 5.3.20.