BTFS 3.3, the latest release of the FUSE module BitTorrent FileSystem, has been published. This module enables users to mount torrent files or magnet links as a file system, functioning like a regular read-only directory. When the content is accessed, the data is loaded dynamically. This feature allows users to, for example, mount a torrent file containing a music album and listen to it in any media player without having to first download it to a local disk. The code for BTFS is written in C++ and distributed under the GPLv3 license. You can access the release here.
In this update, a vulnerability (CVE not assigned) has been addressed. The vulnerability was caused by unsafe practices in handling temporary files. Instead of using the mkdtemp function to create a unique temporary directory, BTFS was using directories with predictable names, such as /tmp/btfs/torrent_hash. This issue could potentially allow attackers to create a symbolic link with a desired name in advance and overwrite arbitrary files on the system. For more information on this fix, you can visit the official GitHub page.