Dear Maintainer,
Upstream PR #24795 fixes unsafe handling of torrent URLs from RSS
articles. The affected code paths are present in version 5.1.0, and
Debian trixie's 5.1.0-2 patches do not fix them.
The RSS automatic downloader passes an article's torrent URL directly
to AddTorrentManager::addTorrent(). A value without a supported scheme
can be treated as a local filesystem path and wrapped in a
TorrentFileGuard. If Core/AutoDeleteAddedTorrentFile is set to Always,
the guard deletes the referenced file even when loading it as a torrent
fails.
An attacker controlling an RSS feed consumed by the application can
therefore target files that the qBittorrent process is permitted to
delete. Automatic exploitation requires an enabled RSS download rule
matching the malicious article and the Always deletion setting. Once
these conditions hold, no further user interaction is required. The
deletion setting defaults to Never.
The upstream fix validates the source before passing it to addTorrent,
allowing only HTTP(S), magnet URIs and info hashes. It also adds
validation to the GUI action for downloading selected RSS articles.
Debian's existing 01_fix-RSS-and-search.patch checks local-file URLs
when opening article or search-result pages in the GUI. It does not
cover these torrent-adding paths, so this is distinct from the existing
CVE-2025-54310 fix.
References:
- Upstream report and fix:
https://github.com/qbittorrent/qBittorrent/pull/24795
- Affected automatic download path:
https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/base/rss/rss_autodownloader.cpp#L478
- Local-file handling and deletion guard:
https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/base/addtorrentmanager.cpp#L81
https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/base/torrentfileguard.cpp
- Existing Debian RSS/search patch:
https://sources.debian.org/patches/qbittorrent/5.1.0-2/01_fix-RSS-and-search.patch/
Could you assess this issue for security tracking and backporting to the
affected supported Debian releases?
This report is based on the upstream disclosure and source inspection;
I have not reproduced an attack.
Kind regards,
Jonatan Nyberg