CVE-2026-57079: Net::BitTorrent Path Traversal Vulnerability

CVE-2026-57079 Overview

CVE-2026-57079 is a path traversal vulnerability [CWE-22] in the Net::BitTorrent Perl module through version 2.0.1. The flaw allows a malicious peer or magnet source to write files outside the intended download directory by supplying crafted metadata containing .. segments. Net::BitTorrent validates path components only on the .torrent ingest path, leaving the peer and magnet metadata path unchecked. Because the same peer controls piece hashes and served bytes, content verification succeeds, enabling attacker-chosen content to be written to attacker-chosen locations on the downloading host.

Critical Impact
A malicious BitTorrent peer can write arbitrary content to arbitrary file paths on any host using Net::BitTorrent with magnet links or peer-supplied metadata.

Affected Products

Net::BitTorrent Perl module versions through 2.0.1
Applications using Net::BitTorrent for magnet link or peer metadata processing
Perl-based BitTorrent clients relying on the Storage::add_file and Storage::_parse_file_tree code paths

Discovery Timeline

2026-06-30 - CVE-2026-57079 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57079

Vulnerability Analysis

The vulnerability resides in how Net::BitTorrent processes metadata received from remote peers. The module correctly validates file path components when ingesting a .torrent file directly. However, when metadata arrives through the peer or magnet path via _on_metadata_received, reached through the BEP09 ut_metadata extension, path validation is skipped entirely. Attacker-supplied file names flow directly into Storage::add_file and Storage::_parse_file_tree.

Inside these functions, Path::Tiny's child() method is used to construct file paths. This method does not collapse .. segments, so relative traversal sequences remain intact. A v2 file tree key, a v1 files[].path element, or a single-file name containing .. segments resolves to a location outside the intended download directory.

Root Cause

The root cause is inconsistent input validation between two metadata ingestion paths. The .torrent file parser enforces path component checks, while the peer and magnet metadata parser trusts remote input. Reliance on Path::Tiny's child() without explicit .. filtering compounds the issue.

Attack Vector

An attacker operates a malicious peer or publishes a crafted magnet link. When a victim client fetches metadata over BEP09, the attacker supplies file names containing .. segments. Because the same peer serves piece data and controls piece hashes, hash verification succeeds. The client writes the attacker's payload to a path outside the download directory, potentially overwriting configuration files, scripts, or startup items writable by the running user.

No verified public exploit code is available. See the GitHub Security Advisory for full technical details.

Detection Methods for CVE-2026-57079

Indicators of Compromise

File writes by Perl processes to paths outside the configured BitTorrent download directory
Unexpected file creation in user home directories, ~/.ssh/, ~/.config/, or system-writable locations by torrent client processes
Peer metadata exchanges via ut_metadata followed by anomalous filesystem activity

Detection Strategies

Monitor process ancestry for perl processes writing files outside declared download directories
Inspect BitTorrent client logs for file names containing .. sequences in received metadata
Correlate BEP09 metadata exchange events with subsequent file creation events on non-download paths

Monitoring Recommendations

Enable filesystem auditing on sensitive paths writable by the user account running the torrent client
Log all outbound peer connections and correlate metadata negotiation with file write telemetry
Alert on any Perl-invoked file write with a normalized path containing parent-directory traversal

How to Mitigate CVE-2026-57079

Immediate Actions Required

Restrict the user account running Net::BitTorrent to a dedicated, unprivileged identity with write access limited to the download directory
Disable magnet link processing and peer metadata exchange (BEP09) in affected applications until a patched release is deployed
Audit hosts running Net::BitTorrent 2.0.1 or earlier for unexpected files created outside the download directory

Patch Information

Refer to the GitHub Security Advisory GHSA-5wc6-r65f-62rr for the maintainer's fix and upgrade guidance. Upgrade to a version later than 2.0.1 once released.

Workarounds

Wrap Storage::add_file and Storage::_parse_file_tree calls with explicit path normalization that rejects .. segments before writing
Run the torrent client inside a filesystem sandbox such as bwrap, firejail, or a container that restricts writes to the download directory
Apply mandatory access control policies (AppArmor, SELinux) that confine the Perl interpreter to the intended download tree

bash

# Configuration example: AppArmor profile fragment restricting write scope
/usr/bin/perl {
  /var/lib/bittorrent/downloads/** rw,
  deny /home/** w,
  deny /etc/** w,
  deny /root/** w,
}