Description

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can leverage this behavior to achieve arbitrary file write and potentially execute code with the privileges of the affected user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T10:16:39.940Z",
  "pubdate": "2026-08-26T10:16:39.940Z",
  "executiveSummary": "This vulnerability involves improper neutralization of path traversal sequences within TeamViewer Desktop Clients prior to version 15.81.5.\nThe security flaw enables an authenticated remote session participant to execute arbitrary file write operations on the host file system by abusing file transfer or virtual file clipboard features.\nBy bypassing intended directory restrictions, an attacker can write malicious files to arbitrary locations, leading to potential remote code execution (RCE) with the security context of the user running the TeamViewer application.\nThe vulnerability requires an established, authenticated remote session, meaning an attacker must already have access to a session with the victim.\nThe risk implication is critical, as successful exploitation facilitates unauthorized system modifications and full compromise of the user's desktop environment.\nOrganizations using versions of TeamViewer Desktop Client earlier than 15.81.5 are exposed and should prioritize updating their software to mitigate this risk.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the TeamViewer Desktop Client to properly sanitize or validate file paths received via the remote session's file transfer or virtual file clipboard mechanisms.\nIn a standard, secure implementation, file transfer operations are restricted to specific, authorized directories or sandboxed environments to prevent arbitrary file placement.\nThe vulnerability allows for the injection of directory traversal sequences (such as '../') within the file path metadata during the transfer process.\nWhen the TeamViewer client processes these malicious path strings, it fails to neutralize the traversal sequences, causing the file system API to resolve the path outside of the intended scope.\nConsequently, an authenticated attacker participating in a remote session can dictate the destination path for transferred files, enabling the overwriting of existing binaries, configuration files, or the placement of malicious executables in startup directories (e.g., shell:startup).\nThe exploitation flow proceeds as follows: 1. An attacker initiates or joins an authenticated TeamViewer session with the target victim. 2. The attacker utilizes the file transfer protocol or the virtual clipboard feature to initiate a file transfer. 3. The attacker intercepts or crafts the transfer packet to include a malicious file name or destination path containing path traversal sequences. 4. The vulnerable TeamViewer component on the host machine processes the path without validation, resulting in the file being written to a directory of the attacker's choosing. 5. If the attacker successfully overwrites a critical system or application binary, or places an executable in a location monitored by the operating system, they can trigger arbitrary code execution upon subsequent system events or user interaction.\nThe impact is significant, as code execution occurs with the privileges of the user who initiated the TeamViewer session. If that user possesses administrative or high-level privileges, the attacker may effectively achieve system-wide compromise. This vulnerability is restricted to environments where a remote session is already established and authenticated, limiting the attack vector to those with existing session access."
}