CVE-2026-72903: Tabby Terminal Lets Malicious SFTP Servers Overwrite Files Through Path Traversal
Tabby versions before 1.0.235 allow a malicious SFTP server to write files outside the download directory via backslash path traversal in entry names on Windows.
Contents
TL;DR: Tabby (formerly Terminus) versions before 1.0.235 have a path traversal vulnerability in its SFTP download handler. A malicious SFTP server can craft filenames with backslash traversal sequences. When a Windows user downloads files or edits them remotely, the traversal escapes the download folder and writes attacker-controlled content anywhere on disk. Fix it by updating to Tabby 1.0.235.
The attack chain
Tabby is a cross-platform terminal emulator built on Electron. It supports SFTP file transfers, letting users connect to remote servers and download files or edit them in a local editor. The vulnerability starts with how Tabby processes filenames returned by the SFTP server.
When an SFTP server sends a directory listing, each entry includes a filename. The attack injects backslash-based traversal sequences into that filename. For example, a filename like ..\..\..\..\Users\Public\exploit.bat contains parent-directory components that Windows interprets as a path.
The chain passes through four code paths:
tabby-ssh/src/session/sftp.ts:SFTPSession.readdir()and_makeFile()use POSIX path processing, which treats backslashes as ordinary filename characters rather than directory separators.tabby-ssh/src/components/sftpPanel.component.ts:downloadFolderRecursive()takesitem.nameand builds a local relative path from it.tabby-electron/src/services/platform.service.ts:ElectronDirectoryDownload.createFile()passes that path topath.join()on Windows, which interprets backslashes as directory separators.tabby-electron/src/sftpContextMenu.ts:EditSFTPContextMenu.edit()passesitem.nametopath.join()for the temporary edit path.
The POSIX layer preserves backslashes harmlessly. The Windows layer converts them into real directory separators. At that point, the parent-directory traversal takes effect and the file lands outside the intended directory.
What Tabby is
Tabby is a popular open-source terminal emulator, formerly known as Terminus. It has over 50,000 GitHub stars and supports SSH, SFTP, serial connections, and local terminals. Windows users make up a significant portion of its install base because it provides a modern terminal experience with tabs, profiles, and integrated SFTP. The app runs on Electron, which means it has direct filesystem access through Node.js APIs.
Anyone who uses Tabby on Windows to connect to SFTP servers is affected. The attack requires no user interaction beyond downloading a file or opening one for editing from a directory listing. A compromised or malicious SFTP server delivers the payload through the filename itself.
Who is affected
Tabby versions prior to 1.0.235 on Windows. macOS and Linux are not affected because their path separators differ and the POSIX processing layer does not create the same traversal behavior. The affected package is Eugeny/tabby.
The attack scales in environments where multiple users connect through the same SFTP infrastructure. A single compromised server can target every Tabby user who downloads from it.
What to do
Update to Tabby 1.0.235 or later. The fix sanitizes filenames returned by SFTP servers to strip parent-directory traversal components before they reach the Windows path.join() call.
Download the latest release from the Tabby GitHub releases page or update through the in-app updater.
Until you can update, avoid downloading files or using the SFTP edit feature against untrusted servers. Connecting to SFTP servers you control is safe as long as the server itself is not compromised.
Why it matters
This is a client-side path traversal. The server delivers the payload through a directory listing, and the terminal emulator blindly trusts the filename. On Windows, the attack can overwrite startup scripts, drop executables into user-registry-run keys, or replace DLLs. A single SFTP session can plant files in locations that execute on next login or reboot.
The vulnerability does not require admin rights on the client. Tabby runs as the current user, and the traversal can reach any directory the user can write to, which includes the startup folder, desktop, and most of the user profile.
NVD enrichment is pending. No CVSS score has been published through official channels. The threat model is specific (malicious SFTP server targeting Windows clients) but the impact for affected users is direct file write outside the intended sandbox.
References
Continue reading
All posts
CVE-2026-72603: wg-easy WireGuard UI Lets Low-Privilege Users Execute Root Commands
wg-easy 15.3.0 has an OS command injection vulnerability in its client creation flow. Users with clients.create permission can inject WireGuard PostUp directives via newlines in the client name field, achieving root code execution.
CVE-2026-72533: Portainer CE Authentication Bypass Grants Root Access to Docker Hosts
Portainer CE through 2.44.0 has an authentication bypass in its Docker proxy endpoint. Low-privileged users can craft non-canonical URL paths to bypass authorization checks and gain root-level access to the Docker host.
CVE-2026-58231: Unauthenticated RCE in SAP Commerce Cloud Data Hub Adapter
SAP Commerce Cloud Data Hub Adapter ships with a default authentication client. An unauthenticated attacker can submit crafted input to validation-lacking functions, achieving arbitrary code execution. No fix available yet.