Loading story…
Tabby released version 1.0.235 to fix CVE-2026-72903 / GHSA-59p9-8gwf-v9v7, a high-severity Windows SFTP path traversal flaw affecting versions prior to the update. The vulnerability allowed a malicious SFTP server to return crafted filenames containing backslashes and .. segments that Tabby preserved, enabling files to be created or overwritten outside the user-selected download folder or temporary edit directory. The issue is rated CVSS 8.1 and is remotely exploitable with user interaction.
The patch introduced a path validation helper, resolveInsideBase, to ensure resolved paths remain within an intended base directory, replacing earlier path handling in directory creation, file creation, and SFTP temporary file workflows in Tabby Electron components. The same release also included two shell injection mitigations by replacing exec() with execFile() in shellIntegration.service and app.ts, alongside unrelated feature updates and bug fixes.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-72903 was published as a high-severity CWE-22 path traversal vulnerability affecting Tabby versions before 1.0.235. The entry states that a malicious SFTP server could use backslash traversal filenames on Windows to create or overwrite files outside the selected download or temporary edit directory.
Tabby released version 1.0.235 with a security fix for GHSA-59p9-8gwf-v9v7, a Windows SFTP path traversal issue that could let a malicious server write files outside the user-selected download directory. The release also included two shell injection mitigations by replacing exec() with execFile() in shellIntegration.service and app.ts.
A Tabby code commit introduced a new resolveInsideBase helper to ensure resolved paths stay within an intended base directory. The patch replaced prior path.join usage in download creation and SFTP temporary file editing paths, mitigating traversal and arbitrary file write risks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Electerm patched a high-severity path traversal flaw, tracked as **CVE-2026-73223**, that could let a malicious SFTP server write attacker-controlled content outside the application's temporary directory. The bug affected versions prior to **3.15.120** and was caused by unsanitized server-controlled filenames being passed into `path.resolve` inside the `editWithSystemEditor` workflow in `src/client/components/sftp/file-item.jsx`. The issue is classified as **CWE-22** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H`, indicating high impact to integrity and availability with user interaction required. A related GitHub commit shows Electerm added filename sanitization in its FTP/SFTP transfer logic, importing a `sanitizeFilename` helper and applying it to file and folder names before resolving destination paths. That remediation hardens transfer and folder-creation operations against unsafe path handling and aligns with the vendor's fix in version **3.15.120**. Organizations using Electerm for remote access or file transfer should upgrade to the patched release and treat untrusted SFTP servers as a potential delivery vector for arbitrary file writes.
Aug 12, 2026
Electerm fixed a high-severity command injection vulnerability tracked as **`CVE-2026-73224`** that could let a malicious FTP or SFTP server execute arbitrary commands on a user's system. The flaw affected versions prior to **`3.15.120`** and was triggered when a user downloaded a crafted folder and then opened **Properties** and used **Calculate Size**. According to the advisory, the application passed a server-controlled folder name into a shell command used to run `du -sh` without properly escaping single quotes, creating a **CWE-78** command injection condition. The issue was addressed in Electerm **`v3.15.120`**, whose release notes describe multiple security fixes for unsafe file-name parsing across custom editor actions, FTP/SFTP transfers, folder size checks, and RDP file transfer workflows. The vulnerability carries a **CVSS 3.1** rating of **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, indicating high impact to confidentiality, integrity, and availability, and users are advised to upgrade to the patched release.
Aug 12, 2026
A high-severity flaw in **Dulwich** tracked as `CVE-2026-42305` allows arbitrary file write and potential remote code execution on Windows when a user clones, fetches, or checks out a malicious Git repository. The bug affects versions `0.10.0` through `1.2.4` and stems from improper validation of tree entry names that Windows interprets as path syntax, including backslashes, NTFS alternate data stream markers, and NTFS `8.3` short-name aliases tied to `.git`. A crafted repository can write files outside the work tree or place executable content such as `.git\hooks\pre-commit.exe` inside the victim’s Git metadata, which Git for Windows may later execute in the user’s context. The project released **Dulwich 1.2.5** to fix the issue, correcting mishandled `core.protectNTFS` and `core.protectHFS` configuration names, enabling `core.protectNTFS` by default on all platforms, and tightening checks to block dangerous names including reserved Windows devices like `CON`, `NUL`, `COM1`, and `LPT1`. Release notes say the update also addresses other security bugs, including unsafe submodule path handling, shell command injection in `ProcessMergeDriver`, unsafe patch filename generation, and improper `receive.maxInputSize` enforcement. Maintainers said there is no effective workaround short of upgrading, and warned that even POSIX users can unknowingly propagate malicious trees to Windows users through pushes or republished repositories.
Jun 29, 2026