CVE-2026-72903

Description

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() use POSIX path processing that preserves the backslashes as ordinary filename characters. In tabby-ssh/src/components/sftpPanel.component.ts, downloadFolderRecursive() propagates item.name into the local relative path. In tabby-electron/src/services/platform.service.ts, ElectronDirectoryDownload.createFile() passes that path to Windows-native path.join(), and in tabby-electron/src/sftpContextMenu.ts, EditSFTPContextMenu.edit() passes item.name to path.join() for the temporary edit path. Windows interprets the preserved backslashes and parent-directory components as traversal, allowing attacker-controlled content to be created or overwritten outside the selected download directory or temporary edit directory. This issue is fixed in version 1.0.235.

Traduire en français

Produits concernés

• Eugeny tabby

Scores CVSS

Faiblesses (CWE)

• CWE-22

Références

• https://github.com/Eugeny/tabby/commit/3a4a41431a61d41dd51d4119e60cad9bf13c3399
• https://github.com/Eugeny/tabby/releases/tag/v1.0.235
• https://github.com/Eugeny/tabby/security/advisories/GHSA-59p9-8gwf-v9v7
• https://github.com/Eugeny/tabby/security/advisories/GHSA-59p9-8gwf-v9v7

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories