CVE-2017-9031

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability...

9.8 CriticalFix available

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.50%Up 1.2 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

Record: CVE-2017-9031
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

Record: CVE-2017-9031
Updated: 2026-11-02

EUVDEUVD-2017-17971 No score

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

Record: EUVD-2017-17971
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fffq-gprj-v9cm 9.8

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability...

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

Record: GHSA-fffq-gprj-v9cm
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

OSV 9.8

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

Record: CVE-2017-9031
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-9031 9.8

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

Record: DEBIAN-CVE-2017-9031
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2017-9031 9.8

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.

Record: UBUNTU-CVE-2017-9031
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-04

OSVMGASA-2017-0449 No score

Updated deluge packages fix security vulnerability

The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file(CVE-2017-9031).

Updated deluge package adds systemd services required to autostart deluge daemon and web services. Note that these services not enabled by default.

Record: MGASA-2017-0449
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10713-1 No score

deluge-2.0.3-4.7 on GA media

These are all security issues fixed in the deluge-2.0.3-4.7 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10713-1
Updated: 2026-11-02

OSVUSN-8979-1 No score

deluge vulnerabilities

It was discovered that the web UI in Deluge did not protect against cross- site request forgery. A remote attacker could possibly use this issue to trick a user into installing a malicious plugin, resulting in the execution of arbitrary code. (CVE-2017-7178)

It was discovered that the web UI in Deluge incorrectly handled certain requests. A remote attacker could possibly use this issue to read arbitrary files. (CVE-2017-9031)

Record: USN-8979-1
Updated: 2026-11-04

Affected products

deluge-torrent deluge

Affected packages

Affected packages
Package	Affected	Fixed
`deluge` Debian:12	before 1.3.13+git20161130.48cedf63-3	1.3.13+git20161130.48cedf63-3
`deluge` Debian:13	before 1.3.13+git20161130.48cedf63-3	1.3.13+git20161130.48cedf63-3
`deluge` Debian:14	before 1.3.13+git20161130.48cedf63-3	1.3.13+git20161130.48cedf63-3
`deluge` Debian:7	before 1.3.3-2+nmu1+deb7u2, plus listed versions 1.3.3-2+nmu11.3.3-2+nmu1+deb7u1	1.3.3-2+nmu1+deb7u2
`deluge` Debian:8 From an advisory covering 2 CVEs	before 1.3.10-3+deb8u1, plus listed versions 1.3.10-3	1.3.10-3+deb8u1
`deluge` Mageia:5	before 1.3.11-1.3.mga5	1.3.11-1.3.mga5
`deluge` Ubuntu:Pro:16.04:LTS	before 1.3.12-1ubuntu1+esm1, plus listed versions 1.3.12-1ubuntu1	1.3.12-1ubuntu1+esm1
`deluge` Ubuntu:Pro:16.04:LTS From an advisory covering 2 CVEs	before 1.3.12-1ubuntu1+esm1, plus listed versions 1.3.12-1ubuntu1	1.3.12-1ubuntu1+esm1
`deluge` openSUSE:Tumbleweed	before 2.0.3-4.7	2.0.3-4.7

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 4, 2026	affected, aliases, references	OSV
Nov 3, 2026	affected, facts	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-9031 is a critical vulnerability (CVSS 9.8) in Deluge-torrent Deluge, published May 16, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.50%, the 84th percentile. Fixed in deluge 1.3.13+git20161130.48cedf63-3.

References

Show 10 moreShow less