Net::BitTorrent versions prior to 2.1.0 allow a peer or magnet link to supply file names that include ".." segments. The library validates path components only when ingesting the .torrent file, but then hands the raw names straight to Storage::add_file and Storage::_parse_file_tree. Path::Tiny's child() does not normalize these segments, so a v2 file‑tree key, a v1 files[]’s path element, or even a single‑file name containing ".." can resolve to a location outside the intended download directory. Because the peer also supplies piece hashes and the data for verification, the integrity check passes, enabling an attacker to write chosen content to an arbitrary path on the host where the client runs.

The Perl library Net::BitTorrent is affected. All installed instances of versions before 2.1.0 are vulnerable. The flaw resides in the core module that processes metadata (both v1 and v2 torrent formats) and can be triggered by any peer or magnet link that provides malformed metadata.

A malicious peer or magnet link can exploit this weakness to write arbitrary files to any path reachable by the downloading host. The EPSS score is less than 1% and the vulnerability is not listed in CISA KEV, but the CVSS score of 5.3 indicates moderate risk to confidentiality, integrity, and availability of the system.