CVE-2025-54310: qBittorrent Path Traversal Vulnerability

CVE-2025-54310 Overview

CVE-2025-54310 is an information exposure vulnerability in qBittorrent versions prior to 5.1.2. The application does not prevent access to local files referenced in link URLs handled by rsswidget.cpp and searchjobwidget.cpp. When a user clicks a link in an RSS feed article or search result, qBittorrent passes the URL directly to the operating system's URL handler without verifying the scheme. A crafted file:// URL can cause the client to open arbitrary local files, potentially exposing sensitive content to the user or to an application registered for that file type.

Critical Impact
Attackers can craft malicious RSS feeds or search results that trigger unintended local file access when a user clicks a link, leading to information disclosure [CWE-669].

Affected Products

qBittorrent versions prior to 5.1.2
Affected component: src/gui/rss/rsswidget.cpp
Affected component: src/gui/search/searchjobwidget.cpp

Discovery Timeline

2025-07-02 - qBittorrent v5.1.2 released with the security fix
2025-07-18 - CVE-2025-54310 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54310

Vulnerability Analysis

The flaw is classified under [CWE-669] Incorrect Resource Transfer Between Spheres. qBittorrent's RSS reader and search plugin widgets accept URLs supplied by untrusted remote content and forward them to QDesktopServices::openUrl() without validating the URL scheme. Because Qt's openUrl() accepts file:// URIs, a remote feed operator or search plugin author can supply a link that points to a local resource on the victim's machine.

When the user activates the link, the local file is opened using the default handler registered on the host. Depending on the target file, this may reveal configuration data, credentials, or trigger execution flows in the associated viewer. Exploitation requires user interaction but no authentication and can be delivered over the network via any RSS feed the victim subscribes to.

Root Cause

The underlying cause is missing URL scheme validation before dispatching links to the desktop environment. In the vulnerable code path, article->link() was passed directly to QDesktopServices::openUrl(QUrl(article->link())) with no check for isLocalFile(). The same pattern existed in the search job widget where result URLs were forwarded without inspection.

Attack Vector

An attacker who controls or can influence an RSS feed, or who authors a malicious qBittorrent search plugin, embeds link entries that use the file:// scheme referencing paths of interest on the target system. When the victim clicks the article title or search result, qBittorrent opens the local file. The attack requires no privileges, is network-delivered, and depends on a single user click.

cpp

// Patched code from src/gui/rss/rsswidget.cpp
// Before: QDesktopServices::openUrl(QUrl(article->link()));
// After: reject local file URLs before opening

// Mark as read
article->markAsRead();

if (const QUrl articleLink {article->link()}; !articleLink.isEmpty() && !articleLink.isLocalFile())
    QDesktopServices::openUrl(articleLink);

// Source: https://github.com/qbittorrent/qBittorrent/commit/ad68813fe879ba245a4f41f105ed8d2114a92971

Detection Methods for CVE-2025-54310

Indicators of Compromise

RSS feed entries containing <link> elements with file:// URI schemes.
qBittorrent search plugin results returning URLs that reference local paths such as file:///etc/passwd or file:///C:/Users/.
Unexpected file open events on the host originating from the qBittorrent process shortly after RSS article interaction.

Detection Strategies

Inspect subscribed RSS feed payloads for non-HTTP URL schemes in <link> and <guid> fields.
Audit installed qBittorrent versions across the fleet and flag any release earlier than 5.1.2.
Correlate qBittorrent process activity with file open telemetry to identify anomalous access to sensitive paths.

Monitoring Recommendations

Log and alert on qBittorrent child process creation or file handler invocations targeting system directories.
Track outbound HTTP traffic from qBittorrent to newly subscribed or low-reputation RSS feed hosts.
Monitor endpoints for qBittorrent binaries matching vulnerable version strings using software inventory tooling.

How to Mitigate CVE-2025-54310

Immediate Actions Required

Upgrade qBittorrent to version 5.1.2 or later on all endpoints where the client is installed.
Remove or disable untrusted RSS feed subscriptions until upgrade is complete.
Disable third-party search plugins from sources that are not verified by the qBittorrent project.

Patch Information

The issue is fixed in the qBittorrent v5.1.2 Release. The relevant upstream patches are commit 6ad073e, which introduces a warning message box when an inappropriate URL is opened, and commit ad68813, which rejects URLs where QUrl::isLocalFile() returns true in the RSS widget code path.

Workarounds

Avoid clicking article titles or search results from untrusted RSS feeds and search plugins until the upgrade is applied.
Restrict qBittorrent's file access using operating system controls such as sandboxing or AppArmor profiles.
Remove any RSS feeds delivered over untrusted or unauthenticated channels from the qBittorrent configuration.

bash

# Verify installed qBittorrent version and upgrade where required
qbittorrent --version

# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade qbittorrent

# macOS via Homebrew
brew upgrade qbittorrent