Medium severity5.9NVD Advisory· Published Nov 3, 2026· Updated Nov 3, 2026
CVE-2026-121546
CVE-2026-121546
Description
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <5.3.20
Patches
Vulnerability mechanics
References
5- github.com/Novik/ruTorrent/blob/v5.3.19/php/settings.phpnvd
- github.com/Novik/ruTorrent/blob/v5.3.19/plugins/datadir/action.phpnvd
- github.com/Novik/ruTorrent/commit/2059ff12464b2ce14fd0f53df8d6b19fb6b8a5ebnvd
- github.com/Novik/ruTorrent/issues/3474nvd
- www.vulncheck.com/advisories/rutorrent-before-5.3.20-path-traversal-via-datadir-plugin-symlink-followingnvd
News mentions
0No linked articles in our index yet.