CVE-2026-121546

ruTorrent versions prior to 5.3.20 are vulnerable to a path traversal flaw within the datadir plugin . The issue arises because the correctDirectory() function fails to resolve symbolic links, allowing authenticated users to bypass the topDirectory jail . By submitting a datadir path via a symlin...

CVE-2026-121546 ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...

CVE-2026-121546: Novik ruTorrent: ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users…

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...