========================================================================
CVE-2026-57079                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-57079
   Distribution:  Net-BitTorrent
       Versions:  through 2.0.1

       MetaCPAN:  https://metacpan.org/dist/Net-BitTorrent
       VCS Repo:  https://github.com/sanko/Net-BitTorrent.pm

Net::BitTorrent versions through 2.0.1 for Perl write files outside the
download directory via path traversal in peer-supplied metadata

Description
-----------
Net::BitTorrent versions through 2.0.1 for Perl write files outside the
download directory via path traversal in peer-supplied metadata.

Net::BitTorrent validates file path components only on the
.torrent-file ingest path. The peer and magnet metadata path
(_on_metadata_received, reached from the BEP09 ut_metadata extension)
passes attacker-supplied file names straight to Storage::add_file and
Storage::_parse_file_tree, where Path::Tiny's child() does not collapse
"..". A v2 file tree key, a v1 files[].path element, or a single-file
name containing ".." segments therefore resolves outside the download
directory.

Because the peer also controls the piece hashes and the served bytes,
content verification passes, so a malicious magnet or peer writes
attacker-chosen content to an attacker-chosen path on the downloading
host.

Problem types
-------------
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
   ('Path Traversal')

Workarounds
-----------
There is no fixed release. Validate metadata file path components on
the peer and magnet ingest path as the .torrent-file path already does
(reject components equal to '', '.', or '..' or containing '/' or '\'),
and confirm each resolved path stays within the download directory
before writing.

References
----------
https://github.com/sanko/Net-BitTorrent.pm/security/advisories/GHSA-5wc6-r65f-62rr