https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 05:32:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338811 EUVD-2026-338811 https://cve.radiocsirt.org/vuln/euvd-2026-338811 https://cve.radiocsirt.org/vuln/fkie_cve-2026-57079 <p>Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata.</p> <p>Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny&#39;s child() does not collapse &#34;..&#34;. A v2 file tree key, a v1 files[].path element, or a single-file name containing &#34;..&#34; segments therefore resolves outside the download directory.</p> <p>Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.</p> <p>Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata.</p> <p>Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny&#39;s child() does not collapse &#34;..&#34;. A v2 file tree key, a v1 files[].path element, or a single-file name containing &#34;..&#34; segments therefore resolves outside the download directory.</p> <p>Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-57079 https://cve.radiocsirt.org/vuln/ghsa-5gfq-2rx4-6vwv <p>Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata.</p> <p>Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny&#39;s child() does not collapse &#34;..&#34;. A v2 file tree key, a v1 files[].path element, or a single-file name containing &#34;..&#34; segments therefore resolves outside the download directory.</p> <p>Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.</p> <p>Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata.</p> <p>Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny&#39;s child() does not collapse &#34;..&#34;. A v2 file tree key, a v1 files[].path element, or a single-file name containing &#34;..&#34; segments therefore resolves outside the download directory.</p> <p>Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.</p> https://cve.radiocsirt.org/vuln/ghsa-5gfq-2rx4-6vwv