CVE-2019-13640: In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp...

Security readout for executives and security teams

qBittorrent before 4.1.7 could be tricked into running unintended system commands when it handled malicious torrent metadata. The reported path involved crafted torrent names, including through RSS feeds. This is business-relevant where qBittorrent is present on workstations, servers, seedboxes, or automation hosts. Exposure is most likely on systems running qBittorrent before 4.1.7, especially where torrent or RSS metadata from untrusted sources is processed and external-program behavior is configured or available. Prioritize remediation where qBittorrent runs on systems with access to sensitive files, internal networks, or automation credentials. Without evidence of active exploitation, this is not KEV-driven emergency work, but the command-execution impact warrants prompt upgrade and exposure review. Mitigation focus: Upgrade qBittorrent to 4.1.7 or a distribution-fixed package.; Review Debian, Fedora, and openSUSE advisories for supported package versions.; Disable qBittorrent external-program execution until upgraded, where operationally feasible..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.