The getFileModtimes function in WebTorrent’s torrent.js incorrectly handles the file.path argument, allowing an attacker to craft a path that escapes the intended directory. This path traversal flaw can be triggered from a remote source, leading to unauthorized reading of arbitrary files on the host. The vulnerability is identified by CWE-22 and public exploits are available, which means that any exposed WebTorrent instance could be used as a foothold to gain sensitive data by reading files outside the expected location.

WebTorrent library up to and including versions 2.8.5 and 3.0.21 is affected. The flaw resides in the File Path Handler component of the package and directly impacts users of these releases who integrate WebTorrent into their applications.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in KEV, suggesting no publicly known large‑scale exploitation campaigns yet. However, because the flaw can be abused remotely and public exploits exist, the threat is significant enough to warrant prompt attention. Attackers need only send a crafted request to a WebTorrent instance that processes a file.path parameter; no additional pre‑conditions are documented.