Dear Maintainer,

Upstream PR #24790 fixes unsafe URL handling in the WebUI's RSS and
search interfaces. The affected code is present in version 5.1.0,
and Debian trixie's 5.1.0-2 patches do not fix these WebUI paths.

The WebUI passes RSS article links and search-result description links
to window.open() without restricting the URL scheme. According to the
upstream report, opening a malicious URI such as javascript: can run
attacker-controlled JavaScript in the WebUI session's origin. That code
can modify settings, including the option to run an external program
when a torrent completes.

Exploitation requires attacker-controlled link content to reach the
RSS/search interface and a user to open the malicious link through the
WebUI. This is not a claim of unauthenticated exploitation merely by
exposing the WebUI port.

The upstream fix restricts navigation to HTTP and HTTPS URLs. It was
released in upstream 5.2.4.

Debian's 01_fix-RSS-and-search.patch addresses opening local files from
the desktop GUI, not JavaScript execution in the WebUI. The other
Debian patch trims external-program setting values; it does not prevent
the attack described here. This issue therefore appears distinct from
the existing CVE-2025-54310 fix.

References:
- Upstream report and fix:
https://github.com/qbittorrent/qBittorrent/pull/24790
- Affected search-result handling in 5.1.0:
https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/webui/www/private/scripts/search.js#L466
- Affected RSS handling in 5.1.0:
https://github.com/qbittorrent/qBittorrent/blob/release-5.1.0/src/webui/www/private/views/rss.html#L300
- Debian 5.1.0-2 patch set:
https://sources.debian.org/patches/qbittorrent/5.1.0-2/

Could you assess this issue for security tracking and backporting to the
affected supported Debian releases?

This report is based on the upstream disclosure and source inspection;
I have not reproduced an attack.

Kind regards,
Jonatan Nyberg