CVE-2026-116748— Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

Quick assessment

Affected

transmission transmission

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Transmission 4.0.0 至 4.1.3 之前的版本在 rpc-server.cc 的 handle_request() 函数中存在一个过于宽松的跨域资源共享（CORS）漏洞，导致 X-Transmission-Session-Id 反 CSRF 令牌可被任意 Web 来源访问。恶意网页可从 409 握手响应中读取该令牌，并对其进行重放以发起 RPC 调用，从而执行 script-torrent-done 脚本、更改下载目录，或删除种子文件及相关数据。

CVSS 8.8 · High Updated Oct 27, 2026

Possible ATT&CK Techniques 3 AI

T1566 · Phishing T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

Source: CVE Program / CVE List V5

Vulnerability Description

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

过度许可的跨域白名单

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
transmission	transmission	4.0.0 ~ 4.1.3	-

II. Public POCs for CVE-2026-116748

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116748

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-116748 (1)

🔗 RCE (kind of) in Transmission BitTorrent's daemon | Joshua Rogers' Scribbles Read full article third-party-advisory

Other References for CVE-2026-116748 (6)

https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560 technical-description
https://github.com/transmission/transmission product
https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e patch
https://github.com/transmission/transmission/pull/8938 issue-tracking patch
https://github.com/transmission/transmission/releases/tag/4.1.3 release-notes
https://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-token third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116748

IV. Related Vulnerabilities

Same product: transmission

Same vendor: transmission

Same weakness: CWE-942