# qBittorrent 5.3 adds Web UI virtual lists, IP range bans, and security fixes

> **Key takeaway:** qBittorrent 5.3 introduces virtual lists in the Web UI by default, IP range banning, and patches an authentication bypass vulnerability in the Web UI.

**Published:** 2026-10-20T13:44:21+00:00 
**Source:** Linuxiac 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/qbittorrent-53-adds-web-ui-virtual-lists-ip-range-bans-and-s.html 

## Summary
qBittorrent 5.3 ships with Web UI improvements including virtual lists for better performance with large torrent sets, new selection and sorting controls, and session pause/resume capabilities. The release adds torrent management features like infohash filtering, IP range bans, and share limit matching. Several security vulnerabilities are patched, including an authentication bypass via spoofed X-Forwarded-For headers and SMTP injection. Networking options expand with I2P tunnel configuration and WebTorrent STUN server settings.

## What's new in qBittorrent 5.3
- **Web UI**: Virtual lists enabled by default for responsiveness with large torrent counts; adds Select All/Invert Selection, secondary column sorting, folder navigation improvements, disk space indication when adding torrents
- **Session control**: Remote pause/resume of entire BitTorrent session via Web UI; option to start sessions paused; configurable shutdown timeout
- **Torrent management**: Filter by infohash, ban IP address ranges, copy file paths from Content tab, match all share limits, reworked .torrent file backups
- **Peer handling**: Outgoing seeding connection settings, max outstanding block requests per peer, new Contribution column in Peers list, request latency and queued tracker announces in Statistics dialog
- **Security fixes**: Authentication bypass via spoofed X-Forwarded-For headers in Web UI; strengthened CSRF detection with Sec-Fetch-Site header; Web API operations now require POST; SMTP injection via unsanitized email content; unauthenticated tracker announcements no longer create torrent entries; IPv6 address filtering corrections
- **Networking**: I2P Peer Exchange and inbound/outbound I2P tunnel length variance options; WebTorrent STUN server configurable via exposed libtorrent setting

## Why it matters
The authentication bypass fix is critical for users running qBittorrent with Web UI exposed to any network beyond localhost. The virtual lists improvement addresses a long-standing performance pain point for headless and remote users managing large torrent libraries.