CVE-2026-121546

MEDIUM 5.9

ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create directories and move torrent data to locations writable by the web server or rtorrent.

CWE	CWE-59
Vendor	novik
Product	rutorrent
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for novik rutorrent

Be the first to know when new medium vulnerabilities affecting novik rutorrent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Affected Versions

Novik / ruTorrent

0 < 5.3.20

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Novik/ruTorrent/issues/3474 github.com: https://github.com/Novik/ruTorrent github.com: https://github.com/Novik/ruTorrent/commit/2059ff12464b2ce14fd0f53df8d6b19fb6b8a5eb github.com: https://github.com/Novik/ruTorrent/blob/v5.3.19/plugins/datadir/action.php#L60 github.com: https://github.com/Novik/ruTorrent/blob/v5.3.19/php/settings.php#L526-L541 vulncheck.com: https://www.vulncheck.com/advisories/rutorrent-before-5.3.20-path-traversal-via-datadir-plugin-symlink-following

Credits

George Chen