CVE-2017-7178
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves ...
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init.py file and (2) causing the victim to download, install, and enable this plugin.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init.py file and (2) causing the victim to download, install, and enable this plugin.
- Record
CVE-2017-7178- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init.py file and (2) causing the victim to download, install, and enable this plugin.
- Record
CVE-2017-7178- Updated
- 2026-11-02
EUVDEUVD-2017-16216 No score
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init.py file and (2) causing the victim to download, install, and enable this plugin.
- Record
EUVD-2017-16216- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xp26-fwf6-j3gx
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves ...
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init.py file and (2) causing the victim to download, install, and enable this plugin.
- Record
GHSA-xp26-fwf6-j3gx- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init.py file and (2) causing the victim to download, install, and enable this plugin.
- Record
CVE-2017-7178- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-7178
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init.py file and (2) causing the victim to download, install, and enable this plugin.
- Record
DEBIAN-CVE-2017-7178- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-7178
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init.py file and (2) causing the victim to download, install, and enable this plugin.
- Record
UBUNTU-CVE-2017-7178- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
OSVUSN-8979-1 No score
deluge vulnerabilities
It was discovered that the web UI in Deluge did not protect against cross- site request forgery. A remote attacker could possibly use this issue to trick a user into installing a malicious plugin, resulting in the execution of arbitrary code. (CVE-2017-7178)
It was discovered that the web UI in Deluge incorrectly handled certain requests. A remote attacker could possibly use this issue to read arbitrary files. (CVE-2017-9031)
- Record
USN-8979-1- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
delugeDebian:12 |
before 1.3.13+git20161130.48cedf63-2 | 1.3.13+git20161130.48cedf63-2 |
delugeDebian:13 |
before 1.3.13+git20161130.48cedf63-2 | 1.3.13+git20161130.48cedf63-2 |
delugeDebian:14 |
before 1.3.13+git20161130.48cedf63-2 | 1.3.13+git20161130.48cedf63-2 |
delugeDebian:7 |
before 1.3.3-2+nmu1+deb7u1, plus listed versions 1.3.3-2+nmu1 |
1.3.3-2+nmu1+deb7u1 |
delugeDebian:8 From an advisory covering 2 CVEs |
before 1.3.10-3+deb8u1, plus listed versions 1.3.10-3 |
1.3.10-3+deb8u1 |
delugeUbuntu:Pro:16.04:LTS |
before 1.3.12-1ubuntu1+esm1, plus listed versions 1.3.12-1ubuntu1 |
1.3.12-1ubuntu1+esm1 |
delugeUbuntu:Pro:16.04:LTS From an advisory covering 2 CVEs |
before 1.3.12-1ubuntu1+esm1, plus listed versions 1.3.12-1ubuntu1 |
1.3.12-1ubuntu1+esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Deluge Web UI 1.3.13 - Cross-Site Request Forgery | 2017-03-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, references | OSV | |
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-7178 is a high vulnerability (CVSS 8.8) in Deluge-torrent Deluge, published March 18, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.02%, the 90th percentile. Fixed in deluge 1.3.13+git20161130.48cedf63-2.
References
git.deluge-torrent.org/deluge/commit?h=develop&id=11e8957deaf0c76fdfbac62d99c8b6c61cfdddf9
dev.deluge-torrent.org/wiki/ReleaseNotes/1.3.14
securityfocus.com/bid/97041
bugs.debian.org/857903
seclists.org/fulldisclosure/2017/Mar/6
debian.org/security/2017/dsa-3856
Show 9 moreShow less
security.gentoo.org/glsa/201703-06
nvd.nist.gov/vuln/detail/CVE-2017-7178
github.com/advisories/GHSA-xp26-fwf6-j3gx
security-tracker.debian.org/tracker/CVE-2017-7178
ubuntu.com/security/CVE-2017-7178
cve.org/CVERecord?id=CVE-2017-7178