CVE-2026-72903

Executive Summary

CVE-2026-72903 is a path traversal vulnerability (CWE-22) in Tabby (formerly Terminus), a popular cross-platform terminal emulator. Prior to version 1.0.235, a malicious SFTP server can return filenames containing backslash traversal sequences (e.g., ..\..\malware.exe) via the entry.name field. Because the application mixes POSIX path processing with Windows-native path.join() calls during recursive directory downloads and temporary file edits, these backslashes are interpreted as path separators on Windows, allowing attacker-controlled content to be written or overwritten outside the intended download directory. The vulnerability has a CVSS score of 8.1 (High) and requires user interaction (e.g., connecting to a rogue SFTP server). The issue is fixed in release 1.0.235; no public PoC or exploit code has been observed.

Technical Analysis

Vulnerability Class: Path Traversal (CWE-22)

Affected Component: All Windows builds of Tabby prior to version 1.0.235 that leverage the SFTP file management and download features.

Mechanism: The flaw stems from an inconsistency in path handling between different modules of the application. The NVD description identifies several specific code paths involved:

1. tabby-ssh/src/session/sftp.ts: The SFTPSession.readdir() and _makeFile() functions process remote filenames using POSIX path semantics. POSIX treats backslashes (\) as ordinary filename characters, not as directory separators. Consequently, a filename such as ..\..\evil.exe is preserved verbatim without sanitization or normalization.

2. tabby-ssh/src/components/sftpPanel.component.ts: The downloadFolderRecursive() method constructs a local relative path by concatenating the remote item.name values. Because the name still contains the backslash traversal sequences, the constructed relative path includes parent-directory components.

3. tabby-electron/src/services/platform.service.ts: The ElectronDirectoryDownload.createFile() function passes the constructed relative path to the Windows-native path.join(). On Windows, path.join() interprets backslashes as path separators. The embedded ..\ components are resolved as parent-directory traversal, causing the final absolute path to point outside the intended download root.

4. tabby-electron/src/sftpContextMenu.ts: The EditSFTPContextMenu.edit() function similarly passes item.name to path.join() when constructing a temporary edit path, enabling the same traversal during the "edit remote file" workflow.

Attack Surface: The attack surfaces are:

• Recursive folder download: A user right-clicks a folder in the SFTP panel and selects "Download" / "Download Recursively".
• Remote file edit: A user right-clicks a remote file and selects "Edit" / "Edit Temporarily", causing the file to be fetched into a temp directory.

Both actions are triggered by UI interaction with a remote SFTP listing, meaning the attacker (operator of the SFTP server) controls the filename values returned in directory listings.

Root Cause: The mismatch between POSIX-normalized paths in the SSH layer and Windows-native path handling in the Electron layer. The application fails to sanitize or canonicalize filenames received from the server before joining them with local filesystem paths.

Technical Detail Assessment: The NVD description provides sufficient code-level detail to understand the exact vulnerable code paths and the version in which the fix was applied. However, no further technical details regarding the exact string manipulation or potential mitigations in the patched code are provided.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description and the vulnerability class. No public PoC exists, and the specific technical steps of exploitation are inferred.

Prerequisites:

• Attacker operates an SFTP server that is reachable by the victim.
• Victim uses a Windows build of Tabby < 1.0.235.
• Victim must be socially engineered to connect to the attacker's SFTP server and either (a) recursively download a folder or (b) edit a remote file.

Step 1: Reconnaissance / Target Identification The attacker identifies targets by advertising a malicious SFTP server on a public IP, or by embedding the server link in a phishing email, chat message, or README file in a public repository. The attacker does not require any prior access to the victim's system. No authentication bypass is required — the victim's credentials are supplied at connection time.

Step 2: Triggering the Vulnerability Class The victim launches Tabby, connects to the attacker's SFTP server, and navigates the remote directory listing. The attacker's server returns a response to the readdir() (directory listing) command with a crafted entry.name field containing backslash traversal sequences. Example (at class level): the attacker sets the filename of a directory named downloads to downloads\..\..\..\Users\<victim>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

Step 3: Payload and Execution Scenario A — Recursive Download:

1. The victim selects the malicious folder and triggers "Download Recursively".
2. Tabby's downloadFolderRecursive() concatenates item.name into a local relative path.
3. The Electron layer calls path.join() with the victim's chosen download folder and the malicious relative path.
4. Windows resolves the backslashes and ..\ components, writing files to the attacker-specified absolute path (e.g., the Windows Startup folder).

Scenario B — Remote Edit:

1. The victim right-clicks a file named ..\..\config.ini and selects "Edit".
2. Tabby's edit() function passes the name to path.join() with the temp directory path.
3. The file is written to a location outside the temp directory, potentially overwriting an existing configuration file (e.g., C:\Users\<victim>\AppData\Roaming\Tabby\config.yaml).

Step 4: Post-Exploitation Impact

• Arbitrary File Write: if the traversal path points to the Windows Startup folder, the attacker can drop a malicious executable or script that executes on next user login, achieving persistent code execution with the victim's privileges.
• Arbitrary File Overwrite: if the traversal path targets an existing configuration or system file (e.g., a hosts file, a DLL in the application's directory, or an SSH key), the attacker can corrupt it or inject malicious content, potentially leading to privilege escalation or credential theft.
• Data Integrity Loss: even without code execution, overwriting critical files can cause denial of service or application malfunction.

Overall, a single failed download action can lead to full system compromise on a Windows workstation.

Impact Assessment

CVSS Rationale (8.1 High):

• Attack Vector: Network (AV:N) — exploitation requires only network connectivity to a malicious server.
• Attack Complexity: Low (AC:L) — no special conditions; the server just returns a crafted filename.
• Privileges Required: None (PR:N) — the attacker does not need any pre-existing access.
• User Interaction: Required (UI:R) — the victim must manually trigger a download or edit command.
• Confidentiality Impact: None (C:N) — the vulnerability does not directly leak data.
• Integrity Impact: High (C:H) — arbitrary write/overwrite outside the intended directory.
• Availability Impact: High (A:H) — overwriting critical system files can cause denial of service.

Affected Systems:

• All Windows builds of Tabby (formerly Terminus) prior to version 1.0.235.
• Linux and macOS builds are not vulnerable in the same way because path.join() on non-Windows platforms treats backslash as an ordinary character; however, the unsafe path is still passed to local filesystem APIs, so exotic filesystems or emulation layers could potentially be affected — insufficient technical detail available to confirm.

Blast Radius:

• Individual Workstations: full file-system write access under the user's privilege level.
• Enterprise Environments: Tabby is commonly used by developers and system administrators. A compromised developer workstation could be leveraged to pivot into CI/CD pipelines, source repositories, or production infrastructure.
• Supply Chain Risk: if an attacker compromises an upstream SFTP mirror or documentation site linking to a malicious server, mass targeting becomes feasible.

Detection Guidance

Note: Specific network payload signatures for this vulnerability are not publicly documented. The following rules detect the vulnerable behavior patterns — backslash-heavy path strings in SFTP directory listings and file-open operations involving paths with ..\ sequences.

Sigma Rule

title: Tabby SFTP Backslash Path Traversal Attempt (CVE-2026-72903)
id: 8f3d1a2e-6b0c-4d5e-9f2a-1c2d3e4f5a6b
status: experimental
description: Detects attempts to exploit CVE-2026-72903 where SFTP server returns filenames containing backslash traversal sequences in Tabby terminal emulator.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72903
author: Valtersit Threat Intel Team
date: 2026/01/01
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        Image|endswith: '\Tabby.exe'
        CommandLine|contains:
            - '\\..\\'
            - '\\..\\..\\'
    selection_editor:
        Image|endswith: '\Tabby.exe'
        CommandLine|contains|all:
            - '--edit'
            - '\\..\\'
    condition: selection_powershell or selection_editor
level: high
falsepositives:
    - Legitimate filenames that contain backslashes are extremely rare on POSIX filesystems.
    - Some development workflows might copy Windows-style paths into commands.

YARA Rule

rule Tabby_SFTP_Backslash_Traversal_CVE_2026_72903 {
    meta:
        author = "Valtersit Threat Intel Team"
        description = "Detects SFTP directory listing responses or local file paths containing backslash traversal sequences associated with CVE-2026-72903."
        severity = "high"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72903"
    strings:
        $s1 = /entry\.name[\s]*=[\s]*"[^"]*\\\\\.\.[\\\\\.\.]*"/ nocase
        $s2 = /(?:[A-Za-z0-9_\-]+\\\\\.\.\\\\[A-Za-z0-9_\-\\\.]+){2,}/ nocase
        $s3 = /CreateFile\([^)]*\\\\\.\.\\/ nocase
        $s4 = /path\.join\([^)]*\\\\\.\.\\/ nocase
    condition:
        any of ($s1, $s2, $s3, $s4)
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT Tabby SFTP Backslash Path Traversal Attempt (CVE-2026-72903)"; flow:established,to_server; content:"|0d 0a|Name:"; within:100; content:"\\..\\"; within:200; classtype:attempted-admin; sid:2026072903; rev:1; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-72903;)

Note: SFTP protocol is encrypted, so network-based detection is not reliable. This rule targets the SSH handshake and is likely to miss the actual payload. It is provided for completeness.

Elastic Detection

sequence by process.entity_id with maxspan=1s
  [process where event.action == "start" and process.name == "Tabby.exe"]
  [file where event.action in ("write", "create") and
   (file.path : "*\\..\\*" or file.path : "*\\..\\..\\*") and
   not file.path : "C:\\Users\\*\\Downloads\\*"]

Splunk SPL Query

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| where EventCode=11 OR EventCode=1
| eval TargetFile = coalesce(TargetFilename, CommandLine)
| search TargetFile="*\\..\\*" AND process_name="Tabby.exe"
| stats count by host, user, process_name, TargetFile
| rename TargetFile as "Suspicious Path (Backslash Traversal)", process_name as "Process"
| table _time, host, user, Process, "Suspicious Path (Backslash Traversal)", count

Wazuh OSSEC Rule

<group name="tabby,">
  <rule id="100303" level="12">
    <decoded_as>syslog</decoded_as>
    <program_name>Tabby</program_name>
    <match>downloadFolderRecursive|EditSFTPContextMenu</match>
    <regex>\\\.\\.</regex>
    <description>Tabby: potential backslash path traversal (CVE-2026-72903) triggered in recursive download or remote edit.</description>
    <group>pci_dss_6.5.1,gpg13_10.1,gdpr_IV_35.7.d,</group>
    <mitre>
      <id>T1566</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

Despite the NVD description explicitly stating "This issue is fixed in version 1.0.235," our tracked patch sources (vendor advisories, commit records, release notes, package manager data) show zero corroborating evidence. This zero-confidence score indicates we cannot independently verify that version 1.0.235 exists as a release or that it contains the fix. Treat this as unpatched until the vendor releases an official advisory.

Immediate Mitigations (no patch available):

1. Block untrusted SFTP servers: Educate users not to connect to SFTP servers from unknown or untrusted sources. Block outbound SFTP/SSH (port 22/tcp, or the custom port) to unauthorized external hosts at the network perimeter.
2. Disable recursive download and remote edit features: If feasible in an enterprise deployment, configure local policies or group policies to restrict usage of these convenience features. The core flaw is in the download/edit workflows — avoiding them eliminates the attack path.
3. Run Tabby with a least-privilege Windows account: Limit the user account used to run Tabby to prevent file writes outside user-writable directories. Note this does not prevent the traversal into the user's own profile (e.g., Startup folder).
4. Use filesystem monitoring: Deploy EDR (Endpoint Detection and Response) solutions that alert on file writes to startup folders, scheduled tasks, or system directories by non-standard processes (specifically Tabby.exe).
5. Network segmentation: If users must connect to external SFTP servers, route the traffic through a bastion host or jump server using a patched SFTP client, or require a proxy that validates responses.

Patch / Upgrade Steps:

1. Verify patched version: Contact the Tabby maintainers or monitor the official GitHub repository (github.com/Eugeny/tabby) for release 1.0.235 or newer. Independently confirm the binary checksum against the published one.
2. Upgrade all Windows endpoints to version 1.0.235 or later once the patch is verified.
3. Portable / packaged variants: If Tabby is distributed via package managers (Scoop, Chocolatey, winget), update the package manifest and push the update via enterprise management tools (Intune, SCCM, or similar).
4. Test before rollout: In a staging environment, connect to a controlled malicious SFTP server and verify that the vulnerable download/edit actions no longer write outside the intended directories.

Long-Term Hardening:

1. Input validation / path canonicalization: The vendor should normalize all remote filenames to reject backslashes on non-POSIX targets. Use path.normalize() after joining, and validate the resolved path starts with the expected base directory on all platforms.
2. Sandboxing: Consider running Tabby under Windows Sandbox, a container, or a dedicated VM for any use case involving untrusted SFTP endpoints. This limits the blast radius of any file-write vulnerability.
3. Application allowlisting: Use AppLocker or WDAC to allow Tabby to write only to designated data directories.
4. User awareness: Train users to only use SFTP clients (including Tabby) with internal, trusted servers, and to report any server that prompts unusual authentication or displays strange directory names.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72903 — Official CVE record with the NVD description and CVSS vector.
2. Tabby GitHub Repository: https://github.com/Eugeny/tabby — Primary source for releases, issue tracking, and the upstream fix (pending verification).
3. Tabby Releases Page: https://github.com/Eugeny/tabby/releases — For confirming availability of version 1.0.235.
4. MITRE ATT&CK — Phishing (T1566): https://attack.mitre.org/techniques/T1566/ — Relevant technique for the social-engineering lures used to drive victims to malicious SFTP servers. Note: This is the only ATT&CK mapping we consider confident; the vulnerability could alternatively be reached via spearphishing links (T1566.002).
5. OWASP Path Traversal Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/File_Path_Canonicalization_Cheat_Sheet.html — General mitigation reference for CWE-22.

Threat Actor Campaigns & Exploit-in-the-Wild: No threat actor campaigns or evidence of exploitation in the wild have been reported for this CVE as of the date of this report. The EPSS score is not yet available. The PoC status is None. CISA KEV status: NO (not listed in the Known Exploited Vulnerabilities catalog).