Executive brief
Net::BitTorrent is a Perl library used to download files via the BitTorrent protocol. A security flaw allows a malicious peer or a specially crafted magnet link to trick the software into writing files to any location on the user's computer instead of the intended download folder. This could allow an attacker to gain full control over the system by overwriting sensitive configuration files or adding malicious scripts.
Technical details
Net::BitTorrent versions through 2.0.1 contain a path traversal vulnerability in the metadata-ingest path used for magnet links and peer-to-peer metadata exchange (BEP09). While the library validates .torrent files, the '_on_metadata_received' routine fails to sanitize file names containing '..' segments. These names are passed to 'Path::Tiny::child', which does not collapse parent directory references, allowing files to be written outside the designated download directory. Because the attacker provides both the metadata (including file hashes) and the file content, the client's integrity checks pass, enabling the creation or overwriting of arbitrary files such as cron jobs or SSH keys, leading to remote code execution.
Affected products
- SANKO Net::BitTorrent <= 2.0.1
Timeline
- 2026-06-28: advisory: GitHub Security Advisory published by vendor
- 2026-06-30: disclosed: CVE published to NVD dataset