CVE-2026-121546: ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following

Published Nov 3, 2026

Updated

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Event

via NVD·04:17 PM

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker needs an authenticated ruTorrent account and must be able to submit a datadir path. Exploitation also requires a symbolic link beneath the attacker’s top directory that points outside the configured topDirectory jail.

What is the practical impact of a successful exploit?

A successful attacker can escape the topDirectory restriction to create directories and move torrent data into locations writable by the web server or rtorrent. The issue can affect integrity and availability, while no confidentiality impact is identified in the supplied severity vector.

Are default installations affected?

The available data does not state whether the datadir plugin is enabled or configured by default. Exposure depends on use of the datadir plugin, authenticated user access, and the presence of a usable symlink path under the user’s top directory.

How can I check whether my deployment is exposed?

Check whether the ruTorrent version is earlier than 5.3.20 and whether the datadir plugin is in use. Also review authenticated users’ top directories for symbolic links that resolve to locations outside topDirectory and are writable by the web server or rtorrent.

CVE-2026-121546: ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the practical impact of a successful exploit?

Are default installations affected?

How can I check whether my deployment is exposed?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the practical impact of a successful exploit?

Are default installations affected?

How can I check whether my deployment is exposed?