endpoint-software-vulnerabilitywidely-deployed-product-advisory

Tabby Fixes Windows SFTP Path Traversal Enabling Arbitrary File Writes

Vulnerability Disclosure · 3 sources · Updated 3mo ago · First seen Aug 10, 2026

Tabby released version 1.0.235 to fix CVE-2026-72903 / GHSA-59p9-8gwf-v9v7, a high-severity Windows SFTP path traversal flaw affecting versions prior to the update. The vulnerability allowed a malicious SFTP server to return crafted filenames containing backslashes and .. segments that Tabby preserved, enabling files to be created or overwritten outside the user-selected download folder or temporary edit directory. The issue is rated CVSS 8.1 and is remotely exploitable with user interaction.

The patch introduced a path validation helper, resolveInsideBase, to ensure resolved paths remain within an intended base directory, replacing earlier path handling in directory creation, file creation, and SFTP temporary file workflows in Tabby Electron components. The same release also included two shell injection mitigations by replacing exec() with execFile() in shellIntegration.service and app.ts, alongside unrelated feature updates and bug fixes.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jul 11, 2026 – Aug 10, 2026

Aug 10, 20263mo ago
CVE-2026-72903 published for Tabby Windows SFTP path traversal
CVE-2026-72903 was published as a high-severity CWE-22 path traversal vulnerability affecting Tabby versions before 1.0.235. The entry states that a malicious SFTP server could use backslash traversal filenames on Windows to create or overwrite files outside the selected download or temporary edit directory.
CVE-2026-72903 - Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
Jul 22, 20263mo ago
Tabby 1.0.235 released with fix for Windows SFTP path traversal
Tabby released version 1.0.235 with a security fix for GHSA-59p9-8gwf-v9v7, a Windows SFTP path traversal issue that could let a malicious server write files outside the user-selected download directory. The release also included two shell injection mitigations by replacing exec() with execFile() in shellIntegration.service and app.ts.
Release v1.0.235 · Eugeny/tabby · GitHub
Jul 11, 20264mo ago
Tabby commit adds path containment checks for SFTP file handling
A Tabby code commit introduced a new resolveInsideBase helper to ensure resolved paths stay within an intended base directory. The patch replaced prior path.join usage in download creation and SFTP temporary file editing paths, mitigating traversal and arbitrary file write risks.
fix SFTP file editing · Eugeny/tabby@3a4a414 · GitHub

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Path Traversal in Tabby SFTP on Windows (CVE-2026-72903)

Affected products

1 linked

Tabby

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Aug 10, 2026

CVE-2026-72903 - Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directoryOpen source ↗

Github WebNews · Jul 22, 2026

Release v1.0.235 · Eugeny/tabby · GitHubOpen source ↗

Github WebNews · Jul 11, 2026

fix SFTP file editing · Eugeny/tabby@3a4a414 · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Tabby Fixes Windows SFTP Path Traversal Enabling Arbitrary File Writes

How this story unfolded

CVE-2026-72903 published for Tabby Windows SFTP path traversal

Tabby 1.0.235 released with fix for Windows SFTP path traversal

Tabby commit adds path containment checks for SFTP file handling

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Electerm fixes SFTP path traversal allowing arbitrary file writes via malicious filenames

Electerm Command Injection Flaw Fixed in FTP/SFTP Folder Handling

Dulwich Windows Git Path Flaw Enables Arbitrary File Write and RCE

Tabby Fixes Windows SFTP Path Traversal Enabling Arbitrary File Writes

How this story unfolded

CVE-2026-72903 published for Tabby Windows SFTP path traversal

Tabby 1.0.235 released with fix for Windows SFTP path traversal

Tabby commit adds path containment checks for SFTP file handling

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

Electerm fixes SFTP path traversal allowing arbitrary file writes via malicious filenames

Electerm Command Injection Flaw Fixed in FTP/SFTP Folder Handling

Dulwich Windows Git Path Flaw Enables Arbitrary File Write and RCE