{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/transmission/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:transmissionbt:transmission:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-116748"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Transmission (\u003c 4.1.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Transmission"],"content_html":"\u003cp\u003eTransmission versions 4.0.0 through 4.1.2 contain a permissive Cross-Origin Resource Sharing (CORS) vulnerability within the \u003ccode\u003ehandle_request()\u003c/code\u003e function in \u003ccode\u003erpc-server.cc\u003c/code\u003e. This vulnerability allows any web origin to read the \u003ccode\u003eX-Transmission-Session-Id\u003c/code\u003e anti-CSRF token during a 409 handshake response. By obtaining this token, an unauthorized actor can perform authenticated RPC requests, resulting in unauthorized configuration changes or data deletion.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthorized remote actor to perform several administrative actions, including:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eModifying the download directory.\u003c/li\u003e\n\u003cli\u003eDeleting torrents and local data.\u003c/li\u003e\n\u003cli\u003eExecuting scripts via the \u003ccode\u003escript-torrent-done\u003c/code\u003e feature, which may lead to arbitrary command execution on the host running the Transmission RPC server.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Transmission to version 4.1.3 or later immediately to resolve the insecure CORS handling.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Transmission RPC interface to trusted networks only using firewall rules or a reverse proxy.\u003c/li\u003e\n\u003cli\u003eReview \u003ccode\u003escript-torrent-done\u003c/code\u003e configurations to ensure that no malicious scripts are configured to trigger upon torrent completion.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T07:48:38Z","date_published":"2026-10-27T07:48:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-transmission-cors-vuln/","summary":"Transmission versions prior to 4.1.3 contain a permissive CORS vulnerability in the RPC server that allows unauthorized origins to capture the X-Transmission-Session-Id token and execute arbitrary RPC commands.","title":"Transmission: Permissive CORS vulnerability (CVE-2026-116748)","url":"https://feed.craftedsignal.io/briefs/2026-10-transmission-cors-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - Transmission","version":"https://jsonfeed.org/version/1.1"}