CVE-2026-113352 in uTox
Summary
by MITRE • 10/20/2026
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in uTox versions up to 0.18.1 represents a critical path traversal flaw rooted in the application's file transfer handling mechanisms. This security defect allows authenticated peers, specifically Tox friends, to exploit the auto-accept feature by supplying maliciously crafted absolute paths or directory traversal sequences such as ../ within their file transfer requests. When a victim has auto-accept enabled for incoming transfers, the software fails to adequately sanitize these input strings before processing them. Consequently, instead of saving the transferred data into the designated local download directory, the application writes the content directly to arbitrary locations on the host filesystem determined by the attacker's provided path. This lack of proper validation and canonicalization of file paths constitutes a classic CWE-22 Improper Limitation of a Pathname to a Restricted Directory vulnerability, enabling an adversary to bypass intended access controls and write files outside the expected sandboxed environment.
The operational impact of this flaw is severe because it facilitates arbitrary file writes with the privileges of the user running the uTox application. Attackers can leverage this capability to overwrite critical system configuration files, such as shell startup scripts like .bashrc or .zshrc, which are executed upon login and could lead to persistent command execution. More insidiously, the vulnerability allows for sophisticated exploitation through the abuse of file transfer resume functionality. By planting crafted .ftinfo records that mimic legitimate state information, an attacker can trigger the ft_find_resumeable() function to load these malicious structures. This mechanism interacts with internal FILE pointers in a way that permits writing directly into /proc/self/mem, which is a virtual memory interface provided by the Linux kernel. Writing to this pseudo-file allows for direct manipulation of the process's own memory space, effectively bypassing standard security mitigations like ASLR and DEP/NX bits because the write occurs within the context of the running application itself rather than through external injection techniques.
This exploitation vector aligns with several ATT&CK tactics related to persistence and privilege escalation. The ability to overwrite shell startup files corresponds to T1546.004 Event Triggered Execution: Unix Shell Configuration Modification, allowing attackers to establish a foothold that persists across reboots or user sessions. Furthermore, the technique of writing to /proc/self/mem is indicative of memory corruption and code execution strategies often seen in advanced persistent threats seeking to evade detection by operating directly within the process space rather than creating new processes. The combination of path traversal leading to arbitrary write operations creates a high-severity risk profile where local or remote attackers can achieve full system compromise if they have established trust with the victim as a Tox friend and the user has auto-accept enabled, which is common in many default configurations for ease of use.
Mitigation strategies must address both the immediate configuration risks and the underlying code defects. Administrators and users should immediately disable the auto-accept feature for file transfers within uTox settings to prevent unsolicited writes from peers. It is crucial to review recent file transfer logs if available to identify any suspicious activity that may have occurred prior to remediation. From a development perspective, the application must implement strict input validation on all file paths received during transfer negotiations, ensuring that only relative paths are accepted and that they resolve within the designated download directory using canonicalization techniques before any I/O operations occur. Additionally, developers should refactor the resume handling logic to avoid relying on unsafe pointer manipulations for memory writes and instead use standard, secure APIs provided by the operating system. Regular security audits focusing on CWE-22 patterns in file handling modules are recommended to prevent similar vulnerabilities from being introduced during future updates or feature additions.