CVE-2026-57079 Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "packageName": "Net-BitTorrent",
    "product": "Net::BitTorrent",
    "programFiles": [
      "lib/Net/BitTorrent/Torrent.pm",
      "lib/Net/BitTorrent/Storage.pm",
      "lib/Net/BitTorrent/Storage/File.pm"
    ],
    "programRoutines": [
      {
        "name": "Net::BitTorrent::Torrent::_on_metadata_received"
      },
      {
        "name": "Net::BitTorrent::Storage::add_file"
      },
      {
        "name": "Net::BitTorrent::Storage::_parse_file_tree"
      }
    ],
    "repo": "https://github.com/sanko/Net-BitTorrent.pm",
    "vendor": "SANKO",
    "versions": [
      {
        "lessThanOrEqual": "2.0.1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]