---
id: "CVE-2026-113352"
kind: "vulnerability"
aliases: ["CVE-2026-113352"]
title: "uTox: path traversal lets Tox friends write arbitrary files and run code"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["desktop-users", "linux", "package", "tox", "utox"]
not_affected_if: ["auto-accept-off", "newer-version"]
published_at: "2026-10-20T11:17:19+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:10:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113352", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# uTox: path traversal lets Tox friends write arbitrary files and run code

uTox through 0.18.1 accepts file transfers whose names contain absolute paths or ../ sequences, so a Tox friend can write files anywhere the client user can. An attacker can overwrite shell startup files or plant crafted .ftinfo resume records to reach code execution on the victim's machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed uTox version against the sources; the affected range is through `0.18.1`
- Check whether auto-accept for incoming file transfers is enabled in uTox settings
- unknown

## Fix

- Move uTox to a version later than `0.18.1`, if the sources name one: unknown
- Disable auto-accept for incoming file transfers until patched

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113352

## From the sources

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_