CVE-2026-124582

4.3 MEDIUMpublic exploit available

Published 2026-11-09 · Updated 2026-11-09

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be performed from remote. The exploit is publicly available and might be used. The reported GitHub issue was closed with the label "not planned".

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weaknesses

CWE-22

Public exploit & PoC references

https://github.com/webtorrent/webtorrent/
https://github.com/webtorrent/webtorrent/issues/3012
https://github.com/webtorrent/webtorrent/pull/3046

All references

https://github.com/webtorrent/webtorrent/
https://github.com/webtorrent/webtorrent/issues/3012
https://github.com/webtorrent/webtorrent/pull/3046
https://vuldb.com/cve/CVE-2026-124582
https://vuldb.com/submit/1039255
https://vuldb.com/vuln/432939
https://vuldb.com/vuln/432939/cti

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2012-20002PoC
HIGHCVE-2014-125130PoC
HIGHCVE-2014-125133PoC
HIGHCVE-2014-125134PoC
HIGHCVE-2015-20123PoC
HIGHCVE-2015-20124PoC
HIGHCVE-2015-20125PoC
HIGHCVE-2016-20100PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.