High severity8.8NVD Advisory· Published Jan 15, 2018· Updated Jun 17, 2026
CVE-2018-5702
CVE-2018-5702
Description
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6cpe:2.3:a:transmissionbt:transmission:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:transmissionbt:transmission:*:*:*:*:*:*:*:*range: <=2.92
- (no CPE)range: <=2.92
Patches
Vulnerability mechanics
References
7- bugs.chromium.org/p/project-zero/issues/detailnvdExploitIssue TrackingTechnical DescriptionThird Party Advisory
- github.com/transmission/transmission/pull/468nvdExploitTechnical DescriptionThird Party Advisory
- www.exploit-db.com/exploits/43665/nvdExploitThird Party AdvisoryVDB Entry
- lists.debian.org/debian-lts-announce/2018/01/msg00020.htmlnvdMailing ListThird Party Advisory
- security.gentoo.org/glsa/201806-07nvdThird Party Advisory
- twitter.com/taviso/status/951526615145566208nvdThird Party Advisory
- www.debian.org/security/2018/dsa-4087nvdThird Party Advisory
News mentions
0No linked articles in our index yet.