CVE-2006-6331: Torrentflux

Medium severity, CVSS 6.0. EPSS: 1.3% chance of exploitation in the next 30 days.

metaInfo.php in TorrentFlux 2.2, when $cfg["enable_file_priority"] is false, allows remote attackers to execute arbitrary commands via shell metacharacters (backticks) in the torrent parameter to (1) details.php and (2) startpop.php.

Affected products

• Torrentflux Torrentflux: version 2.2 only

Published 2006-12-06. Last modified 2026-06-16.