{"id":"CVE-2026-113352","kind":"vulnerability","aliases":["CVE-2026-113352"],"related":[],"title":"uTox: path traversal lets Tox friends write arbitrary files and run code","description":"uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.","summary":"uTox through 0.18.1 accepts file transfers whose names contain absolute paths or ../ sequences, so a Tox friend can write files anywhere the client user can. An attacker can overwrite shell startup files or plant crafted .ftinfo resume records to reach code execution on the victim's machine.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-users","linux","package","tox","utox"],"not_affected_if":["auto-accept-off","newer-version"],"how_to_check":"- Check the installed uTox version against the sources; the affected range is through `0.18.1`\n- Check whether auto-accept for incoming file transfers is enabled in uTox settings\n- unknown","fix":"- Move uTox to a version later than `0.18.1`, if the sources name one: unknown\n- Disable auto-accept for incoming file transfers until patched","status":"open","published_at":"2026-10-20T11:17:19+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:10:52+00:00","updated_at":"2026-10-25T03:10:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:10:52Z","model":"claude-haiku-5-5","output":{"fix":"- Move uTox to a version later than `0.18.1`, if the sources name one: unknown\n- Disable auto-accept for incoming file transfers until patched","reach":"internet","title":"uTox: path traversal lets Tox friends write arbitrary files and run code","impact":"high","summary":"uTox through 0.18.1 accepts file transfers whose names contain absolute paths or ../ sequences, so a Tox friend can write files anywhere the client user can. An attacker can overwrite shell startup files or plant crafted .ftinfo resume records to reach code execution on the victim's machine.","category":"package","nicknames":[],"who_cares":["utox","tox","desktop-users","linux"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker writes arbitrary files and executes code as the user","analyst_note":"Confirm the fixed uTox version and whether auto-accept is the default, using the NVD entry and the uTox project repository.","how_to_check":"- Check the installed uTox version against the sources; the affected range is through `0.18.1`\n- Check whether auto-accept for incoming file transfers is enabled in uTox settings\n- unknown","needs_analyst":true,"not_affected_if":["auto-accept-off","newer-version"],"who_is_affected":"Users running uTox 0.18.1 or earlier with auto-accept of incoming file transfers turned on are exposed, since a Tox friend can send a crafted file name that the client writes to. Installs with auto-accept off still need a user to accept a malicious transfer, and the sources do not say more about who can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3351,"output_tokens":583,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113352':15A,18A '-2026':14A,17A '/proc/self/mem':124C '0.18.1':28B,75C 'absolut':35B,91C 'abus':119C 'accept':29B,100C 'allow':82C 'anywher':46B 'arbitrari':8A,87C 'attack':52B,102C 'auto':99C 'auto-accept':98C 'client':48B 'code':12A,66B,127C 'contain':34B,76C 'craft':60B,110C 'cve':13A,16A 'desktop':20B 'desktop-us':19B 'enabl':101C 'execut':67B,126C 'file':9A,30B,45B,57B,88C,93C,107C,120C 'find':116C 'friend':6A,42B,84C 'ft':115C 'ftinfo':61B,111C 'let':4A 'linux':22B 'load':118C 'machin':72B 'name':33B,94C 'overwrit':54B,104C 'packag':23B 'path':2A,36B,78C 'plant':59B,109C 'pointer':121C 'reach':65B 'record':63B,113C 'resum':62B,112C,117C 'run':11A 'send':90C 'sequenc':38B 'shell':55B,105C 'startup':56B,106C 'tox':5A,24B,41B,83C 'transfer':31B 'travers':3A,79C 'user':21B,49B 'utox':1A,25B,26B,73C 'victim':70B,96C 'vulner':80C 'whose':32B 'write':7A,44B,86C,123C","nicknames":[],"mitigations":[],"who_affected":"Users running uTox 0.18.1 or earlier with auto-accept of incoming file transfers turned on are exposed, since a Tox friend can send a crafted file name that the client writes to. Installs with auto-accept off still need a user to accept a malicious transfer, and the sources do not say more about who can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T11:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113352","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113352","severity":null,"published_at":"2026-10-20T11:17:19+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}