AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

{"timestamp":"2026-06-30T13:52:00.535187Z","id":"CVE-2026-57079","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata.

Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny's child() does not collapse "..". A v2 file tree key, a v1 files[].path element, or a single-file name containing ".." segments therefore resolves outside the download directory.

Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.

CWE-22

https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-5wc6-r65f-62rr

[{"vendor":"SANKO","product":"Net::BitTorrent","defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Net-BitTorrent","programFiles":["lib/Net/BitTorrent/Torrent.pm","lib/Net/BitTorrent/Storage.pm","lib/Net/BitTorrent/Storage/File.pm"],"programRoutines":[{"name":"Net::BitTorrent::Torrent::_on_metadata_received"},{"name":"Net::BitTorrent::Storage::add_file"},{"name":"Net::BitTorrent::Storage::_parse_file_tree"}],"repo":"https://github.com/sanko/Net-BitTorrent.pm","versions":[{"version":"0","lessThanOrEqual":"2.0.1","versionType":"custom","status":"affected"}]}]