CVE-2026-121546 in ruTorrent
Summary
by MITRE • 11/03/2026
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in ruTorrent versions prior to 5.3.20 represents a critical security flaw within the datadir plugin, specifically stemming from an improper handling of symbolic links during directory validation processes. This issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The core technical failure lies in the correctDirectory function, which is designed to enforce a jail by restricting user operations to a designated top-level directory. However, this function fails to resolve symbolic links before performing its boundary checks. Consequently, an attacker who has authenticated access to the ruTorrent interface can exploit this logic gap by submitting a path that points to a symlink located within their allowed topDirectory but resolving to a location outside of it. This bypass allows the user to effectively escape the intended security confinement and interact with arbitrary directories on the underlying file system.
From an operational perspective, the impact of this vulnerability is significant for any deployment where ruTorrent is exposed to untrusted users or when multiple tenants share a single instance without strict isolation. By leveraging the unresolved symbolic links, authenticated attackers can create new directories in locations writable by the web server process or the rtorrent daemon itself. This capability enables several malicious outcomes, including the placement of arbitrary files within sensitive system paths, potential overwriting of existing configuration files, and the movement of torrent data to unauthorized storage areas. In environments where the web server runs with elevated privileges or has broad write access, this could lead to remote code execution if an attacker can upload a script into a directory that is subsequently executed by the application or the operating system. Furthermore, it compromises the integrity of the download management system by allowing users to redirect data streams outside their designated quotas and storage limits.
This vulnerability aligns with MITRE ATT&CK technique T1083: File and Directory Discovery, as well as T1564: Hidden Files and Directories, because it relies on manipulating file system structures to bypass access controls. The exploitation vector is primarily remote via the web interface but requires valid authentication credentials, placing it in the category of authenticated attacks that escalate privileges through configuration errors rather than code execution flaws. To mitigate this risk, administrators must upgrade ruTorrent to version 5.3.20 or later, where the correctDirectory function has been patched to properly resolve symbolic links before validating directory boundaries. Additionally, system-level mitigations include configuring the web server and rtorrent processes with minimal file system permissions using principles of least privilege, ensuring that even if a path traversal occurs, the attacker cannot write to critical directories. Implementing strict input validation on all user-supplied paths and disabling unnecessary plugins like datadir in multi-tenant environments further reduces the attack surface by removing the specific component exploited by this vulnerability.