From 7f93c19f29fa0cf7b3c5cae459345b3cdc1fdc1b Mon Sep 17 00:00:00 2001 From: Nehliin Date: Mon, 26 Oct 2026 22:36:48 +0100 Subject: [PATCH 1/4] Add advisory for vortex-bittorrent --- crates/vortex-bittorrent/RUSTSEC-0000-0000.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 crates/vortex-bittorrent/RUSTSEC-0000-0000.md diff --git a/crates/vortex-bittorrent/RUSTSEC-0000-0000.md b/crates/vortex-bittorrent/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..001f316d2 --- /dev/null +++ b/crates/vortex-bittorrent/RUSTSEC-0000-0000.md @@ -0,0 +1,33 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" + +package = "vortex-bittorrent" + +date = "2026-10-26" + +url = "https://github.com/Nehliin/vortex/pull/164" + + +# You can overwrite arbitrary files that the library can access. +categories = ["file-disclosure"] + +# Freeform keywords which describe this vulnerability, similar to Cargo (optional) +keywords = ["bittorrent", "file", "symlink", "arbitrary-file-write"] + +# only linux is supported +[affected] +os = ["linux"] + +[affected.functions] +"bittorrent::file_store::File::new" = ["< 0.8.0"] + +[versions] +patched = [">= 0.8.0"] +``` + +File paths from torrent metadata were not sanitized properly in `vortex-bittorrent`. A malicious torrent could exploit path traversal or symlink following to cause the library to create or write to files outside the intended download directory. + +This could allow an attacker to overwrite existing files that the application has permission to read and write, provided the torrent's corresponding data is downloaded. + +This was fixed in version 0.8.0 which adds validation to file paths and directory relative filesystem operations. From 7d674513166093e42726bffd54ade7e5b3d0ac82 Mon Sep 17 00:00:00 2001 From: Nehliin Date: Mon, 26 Oct 2026 23:12:19 +0100 Subject: [PATCH 2/4] add title --- crates/vortex-bittorrent/RUSTSEC-0000-0000.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crates/vortex-bittorrent/RUSTSEC-0000-0000.md b/crates/vortex-bittorrent/RUSTSEC-0000-0000.md index 001f316d2..14d6d1b9a 100644 --- a/crates/vortex-bittorrent/RUSTSEC-0000-0000.md +++ b/crates/vortex-bittorrent/RUSTSEC-0000-0000.md @@ -26,6 +26,8 @@ os = ["linux"] patched = [">= 0.8.0"] ``` +# Arbitrary file write from downloading malicious torrents + File paths from torrent metadata were not sanitized properly in `vortex-bittorrent`. A malicious torrent could exploit path traversal or symlink following to cause the library to create or write to files outside the intended download directory. This could allow an attacker to overwrite existing files that the application has permission to read and write, provided the torrent's corresponding data is downloaded. From 15f6ddbc51cc3a5f7fbc1609aa4d3bf9e9e3b3a2 Mon Sep 17 00:00:00 2001 From: Nehliin Date: Mon, 26 Oct 2026 23:18:25 +0100 Subject: [PATCH 3/4] fix path --- crates/vortex-bittorrent/RUSTSEC-0000-0000.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/vortex-bittorrent/RUSTSEC-0000-0000.md b/crates/vortex-bittorrent/RUSTSEC-0000-0000.md index 14d6d1b9a..4f5aca38d 100644 --- a/crates/vortex-bittorrent/RUSTSEC-0000-0000.md +++ b/crates/vortex-bittorrent/RUSTSEC-0000-0000.md @@ -20,7 +20,7 @@ keywords = ["bittorrent", "file", "symlink", "arbitrary-file-write"] os = ["linux"] [affected.functions] -"bittorrent::file_store::File::new" = ["< 0.8.0"] +"vortex-bittorrent::file_store::File::new" = ["< 0.8.0"] [versions] patched = [">= 0.8.0"] From 1ff44560b09845474292dd3c08477608b57b98f4 Mon Sep 17 00:00:00 2001 From: Nehliin Date: Mon, 26 Oct 2026 23:25:59 +0100 Subject: [PATCH 4/4] sigh --- crates/vortex-bittorrent/RUSTSEC-0000-0000.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/vortex-bittorrent/RUSTSEC-0000-0000.md b/crates/vortex-bittorrent/RUSTSEC-0000-0000.md index 4f5aca38d..b1b616cb6 100644 --- a/crates/vortex-bittorrent/RUSTSEC-0000-0000.md +++ b/crates/vortex-bittorrent/RUSTSEC-0000-0000.md @@ -20,7 +20,7 @@ keywords = ["bittorrent", "file", "symlink", "arbitrary-file-write"] os = ["linux"] [affected.functions] -"vortex-bittorrent::file_store::File::new" = ["< 0.8.0"] +"vortex_bittorrent::file_store::File::new" = ["< 0.8.0"] [versions] patched = [">= 0.8.0"]