CVE-2026-72903

Name of the Vulnerable Software and Affected Versions Tabby versions prior to 1.0.235

Description A malicious SFTP server can return a backslash traversal filename through the entry.name variable. The SFTPSession.readdir() and makeFile() functions in tabby-ssh/src/session/sftp.ts use POSIX path processing, which treats backslashes as ordinary characters. Subsequently, the downloadFolderRecursive() function in tabby-ssh/src/components/sftpPanel.component.ts propagates item.name into the local relative path. In tabby-electron/src/services/platform.service.ts, the ElectronDirectoryDownload.createFile() function passes this path to the Windows-native path.join(), and in tabby-electron/src/sftpContextMenu.ts, the EditSFTPContextMenu.edit() function passes item.name to path.join() for the temporary edit path. Because Windows interprets these backslashes and parent-directory components as traversal sequences, an attacker can create or overwrite files outside the selected download or temporary edit directories.

Recommendations Update to version 1.0.235.