Utox
Monthly
Path traversal in uTox through 0.18.1 lets an already-accepted Tox friend write files to arbitrary locations on a victim's machine when the non-default auto-accept file-transfer option is enabled, by sending a filename that is an absolute path or contains ../ sequences. The unsafe name is passed straight to native_autoselect_dir_ft() in src/utox.c without validation, so an attacker can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() later parses, ultimately abusing FILE pointers to write /proc/self/mem and achieve code execution. Exploitation is gated by two preconditions - the sender must be a trusted contact and auto-accept must be turned on - matching the AT:P attack requirement in the 7.7 High CVSS 4.0 vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor fixes are available via pull requests 1602 and 1603.
Path traversal in uTox through 0.18.1 lets an already-accepted Tox friend write files to arbitrary locations on a victim's machine when the non-default auto-accept file-transfer option is enabled, by sending a filename that is an absolute path or contains ../ sequences. The unsafe name is passed straight to native_autoselect_dir_ft() in src/utox.c without validation, so an attacker can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() later parses, ultimately abusing FILE pointers to write /proc/self/mem and achieve code execution. Exploitation is gated by two preconditions - the sender must be a trusted contact and auto-accept must be turned on - matching the AT:P attack requirement in the 7.7 High CVSS 4.0 vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor fixes are available via pull requests 1602 and 1603.