CVE-2017-6503 Qbittorrent CVE debrief

Who should care

Administrators and operators of qBittorrent instances with the WebUI enabled, especially if the interface is reachable by multiple users or over networks where untrusted input may be introduced. Security teams should also care because XSS in an admin UI can lead to session compromise, unauthorized actions, or content tampering.

Technical summary

NVD classifies the flaw as CWE-79 (Cross-Site Scripting) with CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability description states that WebUI in qBittorrent before 3.3.11 did not escape many values. The vendor patch reference and release notes indicate the issue was addressed in the upstream project.

Defensive priority

Medium. This is not a remote code execution issue, but browser-side injection in a management interface can still have meaningful impact. Priority increases if the WebUI is exposed beyond a trusted local network or used by privileged operators.

Recommended defensive actions

• Upgrade qBittorrent to version 3.3.11 or later, which is the first version outside the vulnerable range listed by NVD.
• Review whether the WebUI is exposed to untrusted users or broader network access, and restrict it to trusted administrative networks where possible.
• Verify the vendor patch and release notes to confirm the fix is present in the deployed build.
• Monitor for signs of WebUI abuse or unexpected browser-side behavior from authenticated sessions.
• If immediate upgrading is not possible, reduce exposure of the WebUI and limit who can access it until remediation is complete.

Evidence notes

The CVE description says the WebUI in qBittorrent before 3.3.11 did not escape many values, potentially leading to XSS. NVD marks the weakness as CWE-79 and lists the vulnerable version range as versions through 3.3.10. The supplied references include the upstream patch commit and qBittorrent release notes, supporting that the issue was fixed by the vendor. Timing context is based on the CVE published date of 2017-03-06; the later 2026 modified timestamp reflects record maintenance, not the vulnerability's original disclosure date.

Official resources