qBittorrent Web UI Default Credentials Lead to RCE
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| qBittorrent | qBittorrent client | up to 4.5.5 | — | No fix listed | CNA |
- qBittorrent client VendorqBittorrent Affected up to 4.5.5 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qbittorrent:qbittorrent:*:*:*:*:*:*:*:* | up to 4.5.5 | Vulnerable | qBittorrent |
- cpe:2.3:a:qbittorrent:qbittorrent:*:*:*:*:*:*:*:* Versions up to 4.5.5 Vulnerable ·qBittorrent
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-30801
- 2026-10-03 Alias added: GHSA-vchq-5hmx-6hmp
References
More Qbittorrent vulnerabilities
- TI-2024-34679 qBittorrent before 5.0.1 proceeds with use of https URLs even after certificate validation errors. CVSS 3.1HIGH 8.1
- TI-2019-10249 In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in… CVSS 3.0CRITICAL 9.8
- TI-2017-09460 The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass… CVSS 3.0HIGH 7.1
- TI-2017-04288 WebUI in qBittorrent before 3.3.11 did not escape many values, which could potentially lead to XSS. CVSS 3.0MEDIUM 6.1
- TI-2017-04289 WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking. CVSS 3.0MEDIUM 6.1
- TI-2025-34137 qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2023-30801 · CVE Program
- CVE-2023-30801 · NVD
- FIRST EPSS
- GHSA-vchq-5hmx-6hmp · GitHub Advisory Database · CC BY 4.0
- CVE-2023-30801 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences