Read the docs
TI-2026-41068 Aliases CVE-2026-57079GHSA-5gfq-2rx4-6vwv

Path traversal in SANKO Net::BitTorrent

Priority LOW 30CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata. Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata path (_on_metadata_received, reached from the BEP09 ut_metadata extension) passes attacker-supplied file names straight to Storage::add_file and Storage::_parse_file_tree, where Path::Tiny's child() does not collapse "..". A v2 file tree key, a v1 files[].path element, or a single-file name containing ".." segments therefore resolves outside the download directory. Because the peer also controls the piece hashes and the served bytes, content verification passes, so a malicious magnet or peer writes attacker-chosen content to an attacker-chosen path on the downloading host.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00403 34th percentileScored 2026-11-07
Fix Fixed Net::BitTorrent (SANKO): 2.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SANKONet::BitTorrentbefore 2.1.02.1.0Patch availableCNA
  • Net::BitTorrent VendorSANKO Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA

Remediation

  • Fix · CNA Net::BitTorrent (SANKO) Fixed in 2.1.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SANKO Net::BitTorrent 2.1.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-41071 Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private…Priority LOW 26
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-57079
  2. 2026-10-03 Alias added: GHSA-5gfq-2rx4-6vwv

References

Advisory 1

Other 1

  • TI-2026-41070 Uncontrolled resource consumption in SANKO Net::BitTorrent CVSS 3.1HIGH 7.5
  • TI-2026-41069 Uncontrolled resource consumption in SANKO Net::BitTorrent CVSS 3.1HIGH 7.5
  • TI-2026-41071 Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private… CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences