CVE catalog
CVE-2023-30801
qbittorrent affected and fixed versions
All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and execute arbitrary operating system commands using the "external program" feature in the web user interface. This was reportedly exploited in the wild in March 2023.
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.24% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "qbittorrent",
"status": "vulnerable",
"release": "sid",
"version": "5.3.0-1"
},
{
"name": "qbittorrent",
"status": "vulnerable",
"release": "forky",
"version": "5.3.0-1"
},
{
"name": "qbittorrent",
"status": "vulnerable",
"release": "trixie",
"version": "5.1.0-2"
},
{
"name": "qbittorrent",
"status": "vulnerable",
"release": "bookworm",
"version": "4.5.2-3+deb12u1"
}
],
"fixed_versions": [
{
"bug": null,
"name": "qbittorrent",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "unimportant",
"fixed_version": ""
},
{
"bug": null,
"name": "qbittorrent",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "unimportant",
"fixed_version": ""
},
{
"bug": null,
"name": "qbittorrent",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "unimportant",
"fixed_version": ""
},
{
"bug": null,
"name": "qbittorrent",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "unimportant",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "libtorrent-rasterbar",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.9-bp155.2.3.1"
}
]
}
],
"release": "package hub 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "2.0.9-bp155.2.3.1",
"provider_record_id": "OPENSUSE-SU-2023:0391-1"
},
{
"name": "qbittorrent",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.2-bp155.2.3.1"
}
]
}
],
"release": "package hub 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "4.6.2-bp155.2.3.1",
"provider_record_id": "OPENSUSE-SU-2023:0391-1"
},
{
"name": "libtorrent-rasterbar",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.9-bp155.2.3.1"
}
]
}
],
"release": "package hub 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "2.0.9-bp155.2.3.1",
"provider_record_id": "OPENSUSE-SU-2023:0391-1"
},
{
"name": "qbittorrent",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.2-bp155.2.3.1"
}
]
}
],
"release": "package hub 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "4.6.2-bp155.2.3.1",
"provider_record_id": "OPENSUSE-SU-2023:0391-1"
},
{
"name": "libtorrent-rasterbar",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.9-bp155.2.3.1"
}
]
}
],
"release": "leap 15.4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "2.0.9-bp155.2.3.1",
"provider_record_id": "OPENSUSE-SU-2023:0391-1"
},
{
"name": "qbittorrent",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.2-bp155.2.3.1"
}
]
}
],
"release": "leap 15.4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "4.6.2-bp155.2.3.1",
"provider_record_id": "OPENSUSE-SU-2023:0391-1"
},
{
"name": "libtorrent-rasterbar",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.9-bp155.2.3.1"
}
]
}
],
"release": "leap 15.5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "2.0.9-bp155.2.3.1",
"provider_record_id": "OPENSUSE-SU-2023:0391-1"
},
{
"name": "qbittorrent",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.2-bp155.2.3.1"
}
]
}
],
"release": "leap 15.5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "4.6.2-bp155.2.3.1",
"provider_record_id": "OPENSUSE-SU-2023:0391-1"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [qbittorrent]Unknown
Details (2)
4.5.2-3+deb12u1· amd64 · bookwormAffected
dsa · qbittorrent · debian · bookworm; dsa · qbittorrent · debian · 12
4.5.2-3+deb12u1· arm64 · bookwormAffected
dsa · qbittorrent · debian · bookworm; dsa · qbittorrent · debian · 12
- [qbittorrent-nox]Unknown
Source package: [qbittorrent]
Details (2)
4.5.2-3+deb12u1· amd64 · bookwormAffected
dsa · qbittorrent · debian · bookworm; dsa · qbittorrent · debian · 12
4.5.2-3+deb12u1· arm64 · bookwormAffected
dsa · qbittorrent · debian · bookworm; dsa · qbittorrent · debian · 12
[Debian 13 (Trixie)]
- [qbittorrent]Unknown
Details (4)
5.1.0-2· amd64 · trixieAffected
dsa · qbittorrent · debian · 13
5.1.0-2· arm64 · trixieAffected
dsa · qbittorrent · debian · 13
5.1.4-1~bpo13+1· amd64 · trixie-backportsAffected
dsa · qbittorrent · debian · 13
5.1.4-1~bpo13+1· arm64 · trixie-backportsAffected
dsa · qbittorrent · debian · 13
- [qbittorrent-nox]Unknown
Source package: [qbittorrent]
Details (4)
5.1.0-2· amd64 · trixieAffected
dsa · qbittorrent · debian · 13
5.1.0-2· arm64 · trixieAffected
dsa · qbittorrent · debian · 13
5.1.4-1~bpo13+1· amd64 · trixie-backportsAffected
dsa · qbittorrent · debian · 13
5.1.4-1~bpo13+1· arm64 · trixie-backportsAffected
dsa · qbittorrent · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2023_0391-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-30801]
- [https://osv.dev/vulnerability/openSUSE-SU-2023:0391-1]
- [https://security-tracker.debian.org/tracker/CVE-2023-30801]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-30801.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]