CVE-2026-57079
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A vulnerability in Net::BitTorrent for Perl before version 2.1.0 allows writing files outside the download directory via path traversal in peer-supplied metadata. An attacker can exploit the ut_metadata extension (BEP09) to supply file names containing ".." sequences, bypassing path validation.
Risk Assessment
The organization is at risk of arbitrary file writes by an attacker to any location on the downloading host, potentially leading to overwriting critical system files, code injection, or privilege escalation.
Recommendation
Immediately update Net::BitTorrent to version 2.1.0 or later, which includes a fix for this vulnerability. In the meantime, restrict the use of torrents from untrusted sources and monitor network activity for suspicious ut_metadata requests.
Other vulnerabilities in Net::BitTorrent
See all- CVE-2026-57082Medium
The vulnerability in Net::BitTorrent for Perl before version 2.1.0 generates the MSE Diffie-Hellman private key using a non-cryptographic PRNG based on rand(). This allows a passive observer to recover the PRNG state from cleartext padding, then compute the private key and decrypt the connection.
- CVE-2026-57081High
A vulnerability in the Net::BitTorrent library for Perl (up to version 2.1.0) allows remote memory exhaustion via deeply nested bencoded input. The decoder has no recursion depth limit, and each recursion level keeps a copy of the buffer, causing quadratic memory consumption.
- CVE-2026-57080High
In the Net::BitTorrent library for Perl versions up to and including 2.1.0, there is a remote memory exhaustion vulnerability. The issue is the lack of an upper bound on the message-length prefix in the peer-wire framing, allowing a malicious peer to send a huge prefix and stream data, causing unbounded growth of the input buffer.
Original NVD description (English source)
Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata. Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny's child() does not collapse "..". A v2 file tree key, a v1 files[].path element, or a single-file name containing ".." segments therefore resolves outside the download directory. Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.