SANKO Net::BitTorrent up to 2.0.1 on Perl child files[] path traversal

Summaryinfo

A vulnerability, which was classified as critical, has been found in SANKO Net::BitTorrent up to 2.0.1 on Perl. The affected element is the function child. This manipulation of the argument files[] causes path traversal. The identification of this vulnerability is CVE-2026-57079. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in SANKO Net::BitTorrent up to 2.0.1 on Perl and classified as critical. Affected by this vulnerability is the function child. The manipulation of the argument files[] with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata. Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny's child() does not collapse "..". A v2 file tree key, a v1 files[].path element, or a single-file name containing ".." segments therefore resolves outside the download directory. Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-57079 since 06/23/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/30/2026). MITRE ATT&CK project uses the attack technique T1006 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40288). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Peer-to-Peer Software

Vendor

• SANKO

Name

• Net::BitTorrent

Version

• 2.0.0
• 2.0.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion