EUVD-2026-55844Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Network vector because victim connects to remote SFTP server; UI:R because user must trigger download or edit; C:N because the flaw enables writes only, not reads.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() use POSIX path processing that preserves the backslashes as ordinary filename characters. In tabby-ssh/src/components/sftpPanel.component.ts, downloadFolderRecursive() propagates item.name into the local relative path. In tabby-electron/src/services/platform.service.ts, ElectronDirectoryDownload.createFile() passes that path to Windows-native path.join(), and in tabby-electron/src/sftpContextMenu.ts, EditSFTPContextMenu.edit() passes item.name to path.join() for the temporary edit path. Windows interprets the preserved backslashes and parent-directory components as traversal, allowing attacker-controlled content to be created or overwritten outside the selected download directory or temporary edit directory. This issue is fixed in version 1.0.235.
AnalysisAI
Path traversal in Tabby terminal emulator (prior to 1.0.235) on Windows allows a malicious SFTP server to write or overwrite arbitrary files outside the user-selected download or temporary edit directory. When a Windows user downloads a folder or opens a remote file for editing, server-supplied filenames containing backslash sequences bypass POSIX path handling in the SSH layer and are later resolved by Windows-native path.join(), enabling directory traversal. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) victim is running Tabby on Windows - the traversal behavior depends on Windows interpreting backslashes as directory separators, so Linux and macOS users are not affected; (2) victim connects to an attacker-controlled or compromised SFTP server; (3) victim initiates a folder download via downloadFolderRecursive() or opens a remote file for inline editing via EditSFTPContextMenu.edit(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H yields 8.1, which accurately reflects the threat model: network-reachable exploitation with no required privileges on the victim host, but requiring user interaction - the victim must connect to a malicious SFTP server and actively trigger a folder download or file edit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up a malicious SFTP server and entices a Tabby user on Windows to connect - for example, via a phishing link, a compromised jump host, or a rogue server substituted via DNS manipulation. When the victim browses a directory and downloads a folder or opens a remote file for editing, the server returns filenames containing backslash-encoded traversal sequences such as ..\..\AppData\Roaming\startup-script.bat. … |
| Remediation | Vendor-released patch: Tabby v1.0.235, available at https://github.com/Eugeny/tabby/releases/tag/v1.0.235 and patched via commit https://github.com/Eugeny/tabby/commit/3a4a41431a61d41dd51d4119e60cad9bf13c3399. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all Windows systems for Tabby versions prior to 1.0.235 and disable SFTP functionality or restrict it to an explicit whitelist of known trusted servers only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Tabby terminal emulator versions prior to 1.0.233 allows unauthenticated attackers to execute a
Local code execution in Tabby terminal emulator versions before 1.0.233 occurs when dragging and dropping files containi
Command injection in Tabby (formerly Terminus) terminal emulator before 1.0.234 lets an attacker achieve code execution
Tabby terminal emulator before version 1.0.232 automatically renders malicious URIs from SSH/Telnet servers as clickable
Local code execution in Tabby terminal emulator versions before 1.0.233 occurs when users view attacker-controlled files
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today