qBittorrent沙箱逃逸漏洞
推荐指数 71.0 NO. 013 · 2026.09.07
发布2026/09/06Score1.1kComments228
为什么值得看
qBittorrent存在严重安全漏洞，攻击者可利用其突破系统沙箱限制执行任意代码。对运行BT下载工具的服务器和桌面环境构成直接威胁，建议立即检查版本并升级。
编辑判断
这个漏洞的杀伤力在于BT客户端通常是长期后台运行的低权限应用，用户往往放松警惕。沙箱逃逸意味着攻击者从'只能访问下载目录'跳到'控制整台机器'，而qBittorrent在NAS和服务器场景渗透率极高。
更麻烦的是BT协议的DHT机制天然适合传播恶意种子，形成'投毒-感染-横向移动'的完整攻击链。如果你在用qBittorrent做种站或自动化下载，建议先切到Docker隔离环境并限制网络出口，等补丁落地再评估回退。
社区反馈
负面 174 条评论
核心争论：Mastodon强制JS/客户端才能阅读文本内容是否合理
I'll copy the whole announcement here for those who don't want to click: > I regret to inform everyone that my copy of QBittorrent escaped its sandbox last night and downloaded a whole bunch of content owned by major corporations, and then my copy of Jellyfin broke containment and added those unfort
Thanks. Its insane how "Twitter, but for tech nerds" has a hard requirement to either enable Javascript or download some app.
I had a nice mobile experience. It asks you to log in or create an account, but it’s along the bottom, and you can read all the content fine.