Tabby SFTP Path Traversal Vulnerability Advisory and Fix Details

Vulnerability Overview Vulnerability Name: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory Vulnerability Description: Tabby’s SFTP directory download and "Edit Locally" features contain a path traversal vulnerability on Windows. A malicious SFTP server can cause downloaded content to be written outside the user-selected directory by returning filenames containing backslash traversal components. Affected Scope Affected Versions: <= 1.0.234 Fixed Version: 1.0.235 Severity: High (8.1/10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: None - Integrity: High - Availability: High Remediation 1. Validate SFTP entry names: Validate the SFTP entry name before creating the object. 2. Reject names containing specific characters: Reject names containing , , , , , Windows drive prefixes (e.g., ), and UNC-style prefixes. 3. Do not reuse remote display names: Do not reuse remote display names as local path components unless they have been strictly validated. 4. Parse and validate paths: In and , parse the candidate path and enforce that it remains within the expected base directory. 5. Generate safe temporary filenames: In "Edit Locally," generate a local temporary filename controlled by Tabby instead of directly using the remote filename. 6. Add tests: Add tests for POSIX and Windows path semantics. POC Code Example POC File Layout Example Setup Commands Desktop Reproduction Steps 1. Open Tabby on Windows. 2. Connect to a POSIX host via SSH. 3. Open the SFTP panel. 4. Navigate to the directory containing the folder. 5. Enter . 6. Right-click on . 7. Select "Download Directory". 8. Select the local target: Expected Vulnerability Result The file is written outside the selected target tree: The file should not be able to escape the expected directory: Optional "Edit Locally" Reproduction 1. In the SFTP panel, enter . 2. Right-click on the displayed filename: 3. Select "Edit Locally". 4. In vulnerable Windows builds, Tabby calculates the local temporary path using , causing the file to be written outside the expected temporary editing directory. Impact A malicious or compromised SFTP server can write attacker-controlled content outside the directory selected by the user. Depending on the chosen destination and the victim's workflow, this could create or overwrite files in user-writable locations such as project directories, configuration directories, scripts, or files later used by trusted tools. Remediation Advice Apply defenses at two boundaries: 1. Validate SFTP entry names: Validate the SFTP entry name before creating the object. 2. Reject names containing specific characters: Reject names containing , , , , , Windows drive prefixes (e.g., ), and UNC-style prefixes. 3. Do not reuse remote display names: Do not reuse remote display names as local path components unless they have been strictly validated. 4. Parse and validate paths: In and , parse the candidate path and enforce that it remains within the expected base directory. 5. Generate safe temporary filenames: In "Edit Locally," generate a local temporary filename controlled by Tabby instead of directly using the remote filename. 6. Add tests: Add tests for POSIX and Windows path semantics. Example Inclusion Check This check should be used in conjunction with remote filename validation.

Goal Reached Thanks to every supporter — we hit 100%!

Tabby SFTP Path Traversal Vulnerability Advisory and Fix Details

More from this source