Description

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() use POSIX path processing that preserves the backslashes as ordinary filename characters. In tabby-ssh/src/components/sftpPanel.component.ts, downloadFolderRecursive() propagates item.name into the local relative path. In tabby-electron/src/services/platform.service.ts, ElectronDirectoryDownload.createFile() passes that path to Windows-native path.join(), and in tabby-electron/src/sftpContextMenu.ts, EditSFTPContextMenu.edit() passes item.name to path.join() for the temporary edit path. Windows interprets the preserved backslashes and parent-directory components as traversal, allowing attacker-controlled content to be created or overwritten outside the selected download directory or temporary edit directory. This issue is fixed in version 1.0.235.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-10T21:17:24.980Z",
  "pubdate": "2026-08-10T21:17:24.980Z",
  "executiveSummary": "Tabby (formerly Terminus) prior to version 1.0.235 is vulnerable to a path traversal vulnerability via a malicious SFTP server. The flaw exists due to improper handling of backslash characters returned in filenames during directory listing operations. An attacker operating a malicious SFTP server can supply crafted filenames containing backslashes and parent-directory traversal components via entry.name. When a victim interacts with this server using vulnerable versions of Tabby, the application processes these paths using Windows-native path concatenation functions without adequate sanitization. This allows the attacker to achieve arbitrary file creation and file overwriting outside of the intended target directory on the local file system. The risk implication is significant as it compromises the integrity and confidentiality of the local host system, potentially leading to unauthorized modification of critical system files or user data depending on the privileges of the running application instance. Exploitation requires the user to connect to an attacker-controlled SFTP server and perform recursive download or file editing operations.",
  "technicalDetails": "The vulnerability is rooted in a discrepancy between POSIX path processing and Windows path resolution semantics within Tabby's SFTP handling components. In tabby-ssh/src/session/sftp.ts, the SFTPSession.readdir() and _makeFile() functions utilize POSIX path processing logic which incorrectly treats backslashes '\\' as ordinary filename characters rather than directory separators. When an attacker-controlled SFTP server returns a specially crafted filename containing backslashes and traversal sequences through entry.name, these characters are preserved verbatim in the internal file representation objects.\nDuring subsequent operations, this unsanitized path data is propagated into local file system APIs. Specifically, in tabby-ssh/src/components/sftpPanel.component.ts, the downloadFolderRecursive() function incorporates item.name directly into the local relative path calculation. Furthermore, within the Electron service layer, tabby-electron/src/services/platform.service.ts uses ElectronDirectoryDownload.createFile() to pass the malicious relative path directly into the Windows-native path.join() function. Similarly, tabby-electron/src/sftpContextMenu.ts uses EditSFTPContextMenu.edit() to pass item.name to path.join() when generating temporary file paths for editing operations.\nBecause the underlying operating system is Windows, the API interpreter recognizes the preserved backslashes and parent-directory navigation sequences as path traversal directives. When the application attempts to write downloaded content or temporary editing payloads to disk, path.join() resolves these traversal sequences relative to the base working directory. Consequently, the output stream escapes the intended download directory or temporary edit directory sandbox, allowing the attacker to write files to arbitrary locations on the file system constrained only by the security context and file system permissions of the executing Tabby process. Affected versions comprise all instances of Tabby prior to 1.0.235."
}