CVE-2026-38978

Published: Jun 2, 2026Modified: Jul 22, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Related CWEs

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

References (4)

https://github.com/transmission/transmission/commit/6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8

Source: cve@mitre.org

https://github.com/transmission/transmission/issues/8726

Source: cve@mitre.org

https://github.com/transmission/transmission/pull/8747

Source: cve@mitre.org

https://github.com/transmission/transmission/issues/8726

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.