CVE-2024-40624

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In `torrentpier/library/includes/functions.php`, `get_tracks()` uses the unsafe native PHP serialization format to deserialize user-controlled cookies. One can use phpggc and the chain Guzzle/FW1 to write PHP code to an arbitrary file, and execute commands on the system. For instance, the cookie bb_t will be deserialized when browsing to viewforum.php. This issue has been addressed in commit `ed37e6e52` which is expected to be included in release version 2.4.4. Users are advised to upgrade as soon as the new release is available. There are no known workarounds for this vulnerability.

• CWE-502

• https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.php#L41-L60
• https://github.com/torrentpier/torrentpier/commit/ed37e6e522f345f2b46147c6f53c1ab6dec1db9e
• https://github.com/torrentpier/torrentpier/security/advisories/GHSA-fg86-4c2r-7wxw
• https://github.com/torrentpier/torrentpier/blob/84f6c9f4a081d9ffff4c233098758280304bf50f/library/includes/functions.php#L41-L60
• https://github.com/torrentpier/torrentpier/commit/ed37e6e522f345f2b46147c6f53c1ab6dec1db9e
• https://github.com/torrentpier/torrentpier/security/advisories/GHSA-fg86-4c2r-7wxw

Published

Jul 15, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-40616Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-40617Path traversal vulnerability exists in FUJITSU Network Edgio…6.5
• CVE-2024-40618Whale browser before 3.26.244.21 allows an attacker to execu…9.6
• CVE-2024-40619CVE-2024-40619 IMPACT A denial-of-service vulnerability exi…7.5
• CVE-2024-4062A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 …3.7
• CVE-2024-40620CVE-2024-40620 IMPACT A vulnerability exists in the affecte…7.5
• CVE-2024-40625GeoServer is an open source server that allows users to shar…4.9
• CVE-2024-40626Outline is an open source, collaborative document editor. A …5.4
• CVE-2024-40627Fastapi OPA is an opensource fastapi middleware which includ…5.8
• CVE-2024-40628JumpServer is an open-source Privileged Access Management (P…9.1
• CVE-2024-40629JumpServer is an open-source Privileged Access Management (P…9.8
• CVE-2024-4063A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build…3.7