CVE-2026-38978

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-38978
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38978.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-38978
Downstream
Related
Published
2026-06-02T00:00:00Z
Modified
2026-08-04T17:29:11.559704Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38978.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/transmission/transmission

Affected ranges

Type
GIT
Repo
https://github.com/transmission/transmission
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3b502aca113cdb220c6712ea3ff6d51dcbf8f861
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.1.1"
        }
    ],
    "source": "DESCRIPTION"
}

Affected versions

0.*
0.5
0.6
0.7
0.80
1.*
1.06
1.10
1.11
1.20
1.21
1.22
1.31
1.32
1.40
1.60
1.61
1.70
1.71
1.72
1.73
1.74
1.80
1.80b5
1.81
1.82
1.83
1.90
1.91
2.*
2.00
2.10
2.11
2.12
2.13
2.20
2.20b1
2.20b2
2.20b3
2.20b4
2.21
2.30
2.30b1
2.30b2
2.30b3
2.30b4
2.31
2.32
2.33
2.40
2.40b1
2.40b2
2.40b3
2.50
2.50b1
2.51
2.52
2.60
2.61
2.70
2.71
2.72
2.73
2.74
2.80
2.81
2.82
2.83
2.90
2.91
2.92
3.*
3.00
4.*
4.0.0
4.0.0-beta.1
4.0.0-beta.2
4.0.0-beta.3
4.0.1
4.0.2
4.0.3
4.1.0
4.1.0-beta.1
4.1.0-beta.2
4.1.0-beta.3
4.1.0-beta.4
4.1.0-beta.5

Database specific

vanir_signatures_modified 
"2026-08-04T17:29:11Z"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "target": {
            "file": "libtransmission/torrent.cc"
        },
        "id": "CVE-2026-38978-38c42cac",
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "166882553387948988106096467382596750315",
                "175113025769166825013083259736201448594",
                "336488866217607368536020945033441707883",
                "225266330008085492230438071292286709102"
            ]
        },
        "source": "https://github.com/transmission/transmission/commit/3b502aca113cdb220c6712ea3ff6d51dcbf8f861"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "libtransmission/torrent.cc",
            "function": "tr_torrentSetLocation"
        },
        "id": "CVE-2026-38978-81875926",
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "function_hash": "70897094812369059612233537626272700122",
            "length": 223.0
        },
        "source": "https://github.com/transmission/transmission/commit/3b502aca113cdb220c6712ea3ff6d51dcbf8f861"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "libtransmission/transmission.h"
        },
        "id": "CVE-2026-38978-f8054110",
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "321918193528898346907074831791354210277",
                "198517225307178426413488362152768243683",
                "65871947892873091358581332576218311848",
                "50990009688338743323164226560504140327",
                "269028891716585181787430856935887480451",
                "59087695786334711975627315927711454335",
                "255654246227438110952075573549923356756",
                "277839976757990787490331451791802708353",
                "175539068442126263609840176865312305614",
                "63802277985931760517910498180819183897",
                "264329432659084498814618097793512943587",
                "317062569192368891142367847439860621067",
                "74405595819274142265859025283184249658",
                "247606216357256101290627831877141918225",
                "59311316733034190704604663974576832097",
                "147872710592752772118742535906608714867",
                "157280121872256671348518671650315757216",
                "137937921752662393655694349721357349396",
                "321132124629832360225249547914170412371",
                "132781712905183304282589492423416725916",
                "295912225103497213264112523537746949107",
                "28257236641648981327844681408350451554",
                "283337338148864433488051360389200084753",
                "138716798729103889438986338352968983075",
                "252047538539946911930366532059073621406",
                "286158593263082066274410503118453279631",
                "205317559746970141219135015131279031826",
                "108739002098160919274284961388403902481",
                "65504872356435281931835156417126196162",
                "160456140853246462464436263167770692946",
                "102970696731148296397440012822038387525",
                "64770892867374825286759330127820843975",
                "211181998278154350624666667101275786365",
                "278866632528633667354558123649154401583",
                "96719673472749325044067406542349512355",
                "302873835602535458325495846592085396667",
                "338402916338310316869145806487585029362",
                "86383153380282883693511955227432630866",
                "235337040811488549658320750859177503743",
                "47732868915896285170913054575376764442",
                "105119357962339689466425677823970644665",
                "243866951131943335242463982529508404140",
                "26811562809542747587988692084320455771",
                "4237333604943495198678069368863137248",
                "48099869112887346046928822821242676721",
                "102352096409933099664844079901805211907",
                "266735854575755514071790865794429317780",
                "174611849283067316875328068590203489816",
                "280892899490394279085413874402852146047",
                "11501403959405477739140321395252188073",
                "70499496740662987861208164295838843016",
                "265260971659997809882549741751524555391",
                "68926570456916806545787225464786032212"
            ]
        },
        "source": "https://github.com/transmission/transmission/commit/3b502aca113cdb220c6712ea3ff6d51dcbf8f861"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38978.json"