CVE-2026-57079: Net::BitTorrent Path Traversal Remote File Write Vulnerability

Technical summary

The vulnerability stems from inconsistent path validation in Net::BitTorrent's metadata handling. The library properly validates file paths when parsing .torrent files directly, but this validation is bypassed when processing peer-supplied metadata via the ut_metadata BEP09 extension or magnet link metadata. The vulnerable code paths (_on_metadata_received, Storage::add_file, and Storage::_parse_file_tree) pass unsanitized file names to Path::Tiny's child() method, which does not collapse ".." sequences. Consequently, path components like "../../../etc/passwd" are resolved relative to the download directory root, allowing escape. Since the peer controls both the metadata and piece hashes, the content verification mechanism does not prevent the attack. Affected versions are those prior to 2.1.0; administrators should verify the exact patched version against the vendor's advisory.

Business impact

Organizations and users running Net::BitTorrent for legitimate distribution or downloading may have arbitrary files written to their systems by malicious peers. This could lead to system compromise if attackers write to sensitive directories, configuration overwrite, injection of malicious code into application directories, or privilege escalation if the downloading process runs with elevated rights. The impact depends on where files are written and the system's security posture, but the ability to place attacker-controlled content on disk represents a material integrity risk that could facilitate secondary attacks or supply chain compromise.

Affected systems

Net::BitTorrent versions before 2.1.0 for Perl are affected. Systems using this library for BitTorrent client functionality, particularly in automated or server-side applications that download content from untrusted peers, face the highest risk. The vulnerability requires active peer connections; isolated or private swarms may pose lower risk. Administrators should identify all systems running this library, including embedded uses in Perl applications, and verify their version numbers against the vendor advisory.

Exploitability

Exploitation requires no user interaction and no authentication. An attacker only needs to be a peer in the same BitTorrent swarm or provide a malicious magnet link. The path traversal is trivial to construct and the attack succeeds regardless of the victim's firewall configuration if the client connects to the attacker's peer. CVSS score of 5.3 (Medium) reflects network-based exploitation with low complexity, though the impact is limited to file integrity on the victim system. This is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade Net::BitTorrent to version 2.1.0 or later. Verify the exact patched version and any interim updates by consulting the vendor's official advisory. No workarounds are available; patching is the only reliable mitigation. Organizations unable to upgrade immediately should restrict peer connections to trusted networks, disable magnet link support if possible, or isolate affected systems from critical infrastructure.

Patch guidance

Apply the vendor patch to Net::BitTorrent version 2.1.0 or later. Before upgrading, test in a non-production environment to ensure compatibility with dependent applications. Verify the patched version through the vendor's release notes and digital signatures if available. After patching, confirm the version update took effect and restart any services using the library. Organizations relying on Perl package managers (e.g., CPAN) should ensure the repository is current and sources trusted mirrors.

Detection guidance

Monitor for suspicious file creation outside the intended download directory, particularly in sensitive paths (/etc, /var, application installation directories, or user home directories). File integrity monitoring systems can flag unexpected writes during BitTorrent operations. Network intrusion detection may observe magnet link metadata or ut_metadata extensions containing ".." sequences in file path fields, though this requires deep packet inspection. Log access and modification times to identify when files were created during active peer connections. In forensic analysis, cross-reference file timestamps with BitTorrent session logs to confirm whether suspicious files coincide with client activity.

Why prioritize this

Although assigned a Medium CVSS score, this vulnerability should not be deprioritized for organizations running Net::BitTorrent in production. Path traversal allowing arbitrary file write is a fundamental integrity violation. The lack of KEV designation does not diminish the risk; active exploitation in the wild may not yet be widespread or publicly documented. Prioritize systems that download from untrusted peers, automated download systems, or those with weak file system permissions. Patch promptly; the fix is straightforward and upgrades are typically low-risk.

Risk score, explained

CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N assigns a score of 5.3 (Medium). Attack Vector is Network (no local access required), Attack Complexity is Low (trivial to exploit), Privileges Required and User Interaction are None (unauthenticated, no click needed), and Scope is Unchanged (no privilege escalation or cross-boundary impact). The Confidentiality impact is rated Low because an attacker gains ability to write files, potentially revealing what paths exist or allowing read-back attacks; Integrity impact appears None in the vector but is contradicted by the vulnerability's nature—file write is inherently an integrity violation, suggesting the vector may undervalue this threat. Availability is None because disk-fill DoS is not the primary mechanism. Organizations should treat this as a higher-priority issue than the numerical score suggests due to the absolute nature of arbitrary file placement.

Frequently asked questions