Live › vulnerability › CVE-2026-113352
Go to dashboarduTox through 0.18.1 accepts file transfers whose names contain absolute paths or ../ sequences, so a Tox friend can write files anywhere the client user can. An attacker can overwrite shell startup files or plant crafted .ftinfo resume records to reach code execution on the victim's machine.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Users running uTox 0.18.1 or earlier with auto-accept of incoming file transfers turned on are exposed, since a Tox friend can send a crafted file name that the client writes to. Installs with auto-accept off still need a user to accept a malicious transfer, and the sources do not say more about who can skip it.
No product ranges from the sources yet.
0.18.10.18.1, if the sources name one: unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.
This page as .md · .json · in your agent: get_signal("CVE-2026-113352")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.