CVE-2026-72903 in Tabby
Summary
by MITRE • 08/11/2026
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() use POSIX path processing that preserves the backslashes as ordinary filename characters. In tabby-ssh/src/components/sftpPanel.component.ts, downloadFolderRecursive() propagates item.name into the local relative path. In tabby-electron/src/services/platform.service.ts, ElectronDirectoryDownload.createFile() passes that path to Windows-native path.join(), and in tabby-electron/src/sftpContextMenu.ts, EditSFTPContextMenu.edit() passes item.name to path.join() for the temporary edit path. Windows interprets the preserved backslashes and parent-directory components as traversal, allowing attacker-controlled content to be created or overwritten outside the selected download directory or temporary edit directory. This issue is fixed in version 1.0.235.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability affects Tabby terminal emulator versions prior to 1.0.235 and represents a classic path traversal flaw that exploits differences in how POSIX and Windows filesystems handle backslash characters in filenames. The issue stems from improper handling of SFTP directory listing responses where malicious servers can return filenames containing backslashes that are processed as ordinary characters rather than path separators. The vulnerability manifests through multiple code paths starting with the SFTPSession.readdir() and _makeFile() functions in tabby-ssh/src/session/sftp.ts which process POSIX-style path handling while preserving backslash characters as literal filename components.
The exploitation occurs when downloadFolderRecursive() in tabby-ssh/src/components/sftpPanel.component.ts propagates these malicious filenames into local relative paths without proper sanitization. When these paths are subsequently processed by ElectronDirectoryDownload.createFile() in tabby-electron/src/services/platform.service.ts, the Windows-native path.join() function interprets the preserved backslashes as directory traversal operators, effectively allowing attackers to write files outside of intended download directories. Similarly, EditSFTPContextMenu.edit() in tabby-electron/src/sftpContextMenu.ts passes the malicious item.name directly to path.join() for temporary edit operations, creating additional attack vectors.
This vulnerability aligns with CWE-22 Path Traversal and represents a specific implementation flaw where cross-platform path handling logic fails to account for the semantic differences between POSIX and Windows filesystem conventions. The ATT&CK framework categorizes this under TA0005 Defense Evasion and TA0009 Collection, as attackers could potentially overwrite critical system files or exfiltrate data through crafted SFTP responses. The impact extends beyond simple file corruption to potential privilege escalation scenarios where attackers might gain write access to sensitive directories.
Mitigation strategies should focus on input sanitization at multiple layers including validating and normalizing filenames received from SFTP servers before any path construction occurs. Implementing strict path validation that rejects filenames containing backslashes or other traversal characters would prevent the vulnerability. Additionally, ensuring that all file operations use consistent cross-platform path handling libraries rather than relying on native OS functions that interpret backslashes differently would address the root cause. The fix implemented in version 1.0.235 demonstrates proper input validation and normalization of SFTP filenames to prevent these traversal attacks across all affected code paths.