Open-source package vulnerability · Composer (PHP)
CVE-2024-1651: Deserialization of Untrusted Data in Torrentpier
criticalCVSS 3.1 10.0GHSA-5rwm-2xw8-hh9p
Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization.
Published Feb 20, 2024 · Updated Mar 26, 2026
Affected packages
torrentpier/torrentpier
- Ecosystem
- Composer (PHP)
- Affected
- <= 2.4.1
- Fixed in
- No patched version yet
- Check
composer show torrentpier/torrentpier
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Torrentpier version 2.4.1 allows executing arbitrary commands on the server.
This is possible because the application is vulnerable to insecure deserialization.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology