TI-2026-84352 CVE-2026-121546 · GHSA-rh8c-6348-v25w
Path traversal in ruTorrent datadir plugin lets users escape jail
Priority LOW 27
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links.