Loading vulnerability…
Path Traversal in Tabby SFTP on Windows
CVE-2026-72903 is a path traversal vulnerability in Tabby (formerly Terminus) affecting versions prior to 1.0.235. The flaw arises when a malicious SFTP server returns a filename in entry.name containing backslashes and parent-directory components. In the SFTP handling code, SFTPSession.readdir() and _makeFile() preserve backslashes as ordinary characters through POSIX-style path processing. That untrusted name is then propagated by downloadFolderRecursive() into a local relative path and later passed into Windows-native path handling by ElectronDirectoryDownload.createFile() and by the temporary edit workflow in EditSFTPContextMenu.edit(). On Windows, the preserved backslashes and traversal sequences are interpreted as directory traversal, allowing writes outside the intended destination. As a result, attacker-controlled content can be created or overwritten outside the user-selected download directory or outside the temporary edit directory.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a malicious SFTP server to cause arbitrary file creation or overwrite on a Windows system outside the intended download or temporary edit location. The primary impact is high integrity loss because attacker-controlled content can be written to unintended filesystem locations, and high availability impact because overwriting files may disrupt applications or system operation. No direct confidentiality impact is indicated by the available information.
If you can’t patch tonight, do this now.
Until the patched version is deployed, avoid using Tabby on Windows to download from or edit files on untrusted or attacker-controlled SFTP servers. Restrict SFTP access to trusted servers only, and avoid recursive folder downloads or remote file editing workflows from untrusted endpoints. Additional operational mitigation includes running the client with minimal filesystem privileges to reduce the impact of unintended file overwrite.
Patch, then assume compromise.
Upgrade Tabby to version 1.0.235 or later, which fixes the vulnerable path handling. The remediation requires ensuring that SFTP-supplied filenames are normalized and validated in a platform-safe manner before being used in local filesystem operations, particularly on Windows where backslashes and parent-directory components must not be allowed to escape the intended destination directory.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.