qBittorrent 5.3 adds Web UI virtual lists, IP range bans, and security fixes

qBittorrent 5.3 ships with Web UI improvements including virtual lists for better performance with large torrent sets, new selection and sorting controls, and session pause/resume capabilities. The release adds torrent management features like infohash filtering, IP range bans, and share limit matching. Several security vulnerabilities are patched, including an authentication bypass via spoofed X-Forwarded-For headers and SMTP injection. Networking options expand with I2P tunnel configuration and WebTorrent STUN server settings.

What's new in qBittorrent 5.3

• Web UI: Virtual lists enabled by default for responsiveness with large torrent counts; adds Select All/Invert Selection, secondary column sorting, folder navigation improvements, disk space indication when adding torrents
• Session control: Remote pause/resume of entire BitTorrent session via Web UI; option to start sessions paused; configurable shutdown timeout
• Torrent management: Filter by infohash, ban IP address ranges, copy file paths from Content tab, match all share limits, reworked .torrent file backups
• Peer handling: Outgoing seeding connection settings, max outstanding block requests per peer, new Contribution column in Peers list, request latency and queued tracker announces in Statistics dialog
• Security fixes: Authentication bypass via spoofed X-Forwarded-For headers in Web UI; strengthened CSRF detection with Sec-Fetch-Site header; Web API operations now require POST; SMTP injection via unsanitized email content; unauthenticated tracker announcements no longer create torrent entries; IPv6 address filtering corrections
• Networking: I2P Peer Exchange and inbound/outbound I2P tunnel length variance options; WebTorrent STUN server configurable via exposed libtorrent setting

Why it matters

The authentication bypass fix is critical for users running qBittorrent with Web UI exposed to any network beyond localhost. The virtual lists improvement addresses a long-standing performance pain point for headless and remote users managing large torrent libraries.