UBUNTU-CVE-2026-116748: CSRF
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Transmissionto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs a victim to visit a malicious web page while the victim can access the Transmission RPC service. No authentication privileges are required by the attacker, but exploitation requires user interaction.
Which deployments are affected?
Transmission versions from 4.0.0 before 4.1.3 are affected. The issue is in the RPC server's handling of CORS requests, so systems exposing or using the RPC interface are relevant.
What could an attacker do after obtaining the session token?
A malicious page can replay the exposed X-Transmission-Session-Id token to make RPC calls. The stated impacts include executing script-torrent-done, changing the download directory, and deleting torrents and data.
What version resolves the issue?
Upgrade Transmission to version 4.1.3 or later.