CVE-2026-116748
Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token
transmission transmission
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 4.1.3transmissionCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 1
1 outlet mention it. Reports are not confirmation; each links to its source.
Description
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
Text from CVE List
Affected versions 1
- transmissionaffected: 4.0.0 before 4.1.3CVE List
References 7
- github.com/transmission/transmission/pull/8938Fixvia CVE List
- github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929eFixvia CVE List
- github.com/transmission/transmission/releases/tag/4.1.3Fixvia CVE List
- joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploitAdvisoryvia CVE List
- vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-tokenAdvisoryvia CVE List
- github.com/transmission/transmissionReferencevia CVE List
- github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560Referencevia CVE List