If your qBittorrent WebUI sits behind nginx, Caddy or another reverse proxy, 5.3.0, released on 20 October, is the update to take. It closes an authentication bypass in how the WebUI worked out the client’s address from X-Forwarded-For, and it changes how trusted-proxy lists are read, so there is one setting to check afterward. If nobody outside your network can reach the WebUI, the security item matters less, but the rest of the release is still worth having.

The bypass, and the check after the update

With reverse proxy support enabled, the WebUI read the client address from X-Forwarded-For. The pull request that fixes it describes the flaw plainly: the code “picked the first entry accepted by QHostAddress::isGlobal(),” intending to skip past client-supplied entries, “but isGlobal() also accepts private addresses, so the leftmost entry, which the client controls, was always chosen.” The same text states the consequence: “any client that can reach a trusted proxy which appends to the header can send X-Forwarded-For: <whitelisted address> and be treated as that address, bypassing the subnet whitelist and evading the failed-login ban.”

The fix walks the header from the nearest hop outwards, skipping trusted proxies; the first remaining hop is the client, and a client-supplied entry is honored only if every hop after it is a trusted proxy. That produces the behavior change worth checking: “a setup whose trusted-proxy list omits an intermediate hop now resolves to that hop rather than past it.” If your proxy chain includes a hop your list does not name, the address the WebUI sees changes, so confirm your whitelist still matches what you expect. There is no CVE or advisory number attached to this fix; “fixed in 5.3.0” is the marker.

The rest of the security pass

The same release tightens cross-site handling. The WebUI now detects cross-site requests using the Sec-Fetch-Site header, and endpoints that change state, search/downloadTorrent and rss/setFeedRefreshInterval, require POST. Alongside those sit fixes for SMTP injection from unsanitized mail content, an unauthenticated announce that could create a torrent entry, HTTPS for dynamic DNS, and IPv6 parsing and comparison errors.

What else is worth having

This is not a patch-only release. The BitTorrent session gained WebUI controls: start paused, a shutdown timeout, and pause and resume for the whole session, which helps when a host has to go quiet for a while. RSS work is the other cluster: a Clone Rule feature, export and import for rules so a working setup can move to another instance, an “All” sticky item, exponential backoff for refresh intervals, and a shared download window. Torrent housekeeping gets a revamp of .torrent file backup management and an option to match all share limits. The WebUI itself enables its virtual list by default, keeps search tabs between restarts and across sessions, and shows free disk space in the add-torrent window. One privacy default changes for new installations only: “Resolve peer countries” is off, and existing configurations are unaffected.

Updating

The release assets cover the usual ground: a source tarball, an AppImage and a Windows installer, each with a detached .asc signature, and a second set with lt12 in the name for the libtorrent 1.2 flavor. Pick deliberately if you depend on a particular libtorrent version. Windows users have the installer and Linux users the AppImage, and the project documents a headless (nox) version as well; these assets carry no GUI or headless label, so confirm how your chosen route is packaged. There is no official container image, so update your chosen image with whatever tag you follow.

If the WebUI is reachable from outside, the bypass is the reason to move now, and the trusted-proxy list is the part to read twice. If it is not, 5.3.0 still lands a stack of small, useful things.

Sources: the 5.3.0 release record and PR #24889; the project site.