Source: qbittorrent Version: 5.1.0-2 Tags: security upstream fixed-upstream X-Debbugs-CC: [email protected]
Dear Maintainer, Upstream PR #24790 fixes unsafe URL handling in the WebUI's RSS and search interfaces. The affected code is present in version 5.1.0, and Debian trixie's 5.1.0-2 patches do not fix these WebUI paths. The WebUI passes RSS article links and search-result description links to window.open() without restricting the URL scheme. According to the upstream report, opening a malicious URI such as javascript: can run attacker-controlled JavaScript in the WebUI session's origin. That code can modify settings, including the option to run an external program when a torrent completes. Exploitation requires attacker-controlled link content to reach the RSS/search interface and a user to open the malicious link through the WebUI. This is not a claim of unauthenticated exploitation merely by exposing the WebUI port. The upstream fix restricts navigation to HTTP and HTTPS URLs. It was released in upstream 5.2.4. Debian's 01_fix-RSS-and-search.patch addresses opening local files from the desktop GUI, not JavaScript execution in the WebUI. The other Debian patch trims external-program setting values; it does not prevent the attack described here. This issue therefore appears distinct from the existing CVE-2025-54310 fix. References: - Upstream report and fix: https://github.com/qbittorrent/qBittorrent/pull/24790 - Affected search-result handling in 5.1.0: https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/webui/www/private/scripts/search.js#L466 - Affected RSS handling in 5.1.0: https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/webui/www/private/views/rss.html#L300 - Debian 5.1.0-2 patch set: https://sources.debian.org/patches/qbittorrent/5.1.0-2/ Could you assess this issue for security tracking and backporting to the affected supported Debian releases? This report is based on the upstream disclosure and source inspection; I have not reproduced an attack. Kind regards, Jonatan Nyberg
