CVE-2026-72903 Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
A malicious SFTP server can write files outside the download directory in Tabby terminal emulator on Windows, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-72903?
CVE-2026-72903 is a high-severity path traversal vulnerability in Eugeny tabby, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() use POSIX path processing that preserves the backslashes as ordinary filename characters. In tabby-ssh/src/components/sftpPanel.component.ts, downloadFolderRecursive() propagates item.name into the local relative path. In tabby-electron/src/services/platform.service.ts, ElectronDirectoryDownload.createFile() passes that path to Windows-native path.join(), and in tabby-electron/src/sftpContextMenu.ts, EditSFTPContextMenu.edit() passes item.name to path.join() for the temporary edit path. Windows interprets the preserved backslashes and parent-directory components as traversal, allowing attacker-controlled content to be created or overwritten outside the selected download directory or temporary edit directory. This issue is fixed in version 1.0.235.
Weakness: CWE-22
Which versions are affected by CVE-2026-72903?
How do I fix CVE-2026-72903?
No fix has been published for CVE-2026-72903 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-72903 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72903 exists.
Sources
Also known as GHSA-59p9-8gwf-v9v7.