https://tsvinc.dev/tags/transmission/ Recent content in Transmission on tsvinc Hugo en-us Tue, 07 Jul 2026 00:00:00 +0000 https://tsvinc.dev/posts/transmission-rce-by-default/ Tue, 07 Jul 2026 00:00:00 +0000 https://tsvinc.dev/posts/transmission-rce-by-default/ <div class="tldr"> <span class="tldr-label">TL;DR</span> Transmission's <code>script-torrent-done-filename</code> runs an executable of your choosing as the daemon user every time a torrent completes, and it is settable over the RPC interface — so anything that can reach the RPC port and pass its auth chooses what the daemon executes. That is remote code execution by design, not a bug, and you cannot seccomp it away because the daemon legitimately needs <code>execve</code>. Narrow who can reach the RPC (the whitelist takes shell globs, not CIDR), then cage what an escaped command can touch with a systemd sandbox. </div> <p>The obvious way to stop a program from running arbitrary commands is to take away its ability to run commands. systemd has a knob for exactly this:</p>