CVE-2026-72903: Tabby Terminal Path Traversal Vulnerability

CVE-2026-72903 Overview

Tabby (formerly Terminus) is a highly configurable terminal emulator with SFTP client capabilities. CVE-2026-72903 is a path traversal vulnerability [CWE-22] affecting Tabby versions prior to 1.0.235. A malicious SFTP server can return filenames containing backslash traversal sequences through the entry.name field. The Tabby client processes these filenames using POSIX path handling, which preserves backslashes as ordinary characters. When Windows later interprets the resulting path, the backslashes and parent-directory components enable file writes outside the intended download or temporary edit directory. The issue is fixed in version 1.0.235.

Critical Impact
A malicious SFTP server can write or overwrite attacker-controlled files anywhere the Tabby process can reach on a Windows host, enabling arbitrary file placement and potential code execution via user-writable startup locations.

Affected Products

Tabby terminal emulator versions prior to 1.0.235
tabby-ssh SFTP client component on Windows
tabby-electron platform service and SFTP context menu on Windows

Discovery Timeline

2026-08-10 - CVE-2026-72903 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72903

Vulnerability Analysis

The vulnerability stems from a mismatch between POSIX and Windows path semantics in Tabby's SFTP client. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir() and _makeFile() process directory entries using POSIX path functions. POSIX treats backslashes as ordinary filename characters, so a malicious server returning entry.name values such as ..\..\..\Users\victim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.exe passes through validation intact.

The tainted name propagates into downloadFolderRecursive() in tabby-ssh/src/components/sftpPanel.component.ts, which builds a local relative path from item.name. That path is then handed to Windows-native path.join() in ElectronDirectoryDownload.createFile() (tabby-electron/src/services/platform.service.ts) and in EditSFTPContextMenu.edit() (tabby-electron/src/sftpContextMenu.ts). Windows resolves the backslashes and .. segments, redirecting the write outside the selected directory.

Root Cause

The root cause is inconsistent path parsing between the SFTP session layer and the local filesystem layer. POSIX path routines preserve backslashes and do not reject parent-directory traversal in filenames, while Windows path.join() interprets both. No validation confirms that the resolved target remains inside the intended base directory.

Attack Vector

Exploitation requires a victim to connect to an attacker-controlled SFTP server and either download a folder or open a remote file for editing. The server returns crafted entry.name values containing ..\ sequences. Because the attack is delivered through a legitimate SFTP session, no additional privileges are required on the client, though user interaction to initiate the transfer is needed.

typescript

// Security patch: resolveInsideBase() enforces containment
// Source: https://github.com/Eugeny/tabby/commit/3a4a41431a61d41dd51d4119e60cad9bf13c3399

/**
 * Resolve `relativePath` against `basePath` and ensure the result stays inside `basePath`.
 */
export function resolveInsideBase (basePath: string, relativePath: string): string {
    const base = path.resolve(basePath)
    const target = path.resolve(base, relativePath)
    const rel = path.relative(base, target)
    if (rel !== '' && (rel === '..' || rel.startsWith('..' + path.sep) || path.isAbsolute(rel))) {
        throw new Error(`Refusing access outside the target directory: ${relativePath}`)
    }
    return target
}

Detection Methods for CVE-2026-72903

Indicators of Compromise

Files written by the Tabby process (tabby.exe) outside the user-selected SFTP download directory, particularly in %APPDATA%, %LOCALAPPDATA%, or Startup folders.
SFTP server logs returning directory entries whose names contain ..\, ..%5C, or embedded backslash sequences.
Unexpected files under %TEMP% created by Tabby during remote edit operations that resolve to parent directories.

Detection Strategies

Monitor file creation events where the parent process is tabby.exe and the target path escapes the user's Downloads or Temp directory.
Inspect SFTP protocol traffic for filename entries containing backslashes or parent-traversal tokens returned from remote servers.
Audit installed Tabby versions across the fleet and flag hosts running any release prior to 1.0.235.

Monitoring Recommendations

Enable file integrity monitoring on Windows Startup folders and user profile directories to detect anomalous writes.
Alert on Tabby process writes to executable extensions (.exe, .dll, .lnk, .bat) outside expected working directories.
Correlate outbound SFTP connections from Tabby with subsequent unexpected file system modifications.

How to Mitigate CVE-2026-72903

Immediate Actions Required

Upgrade Tabby to version 1.0.235 or later on all Windows hosts.
Avoid connecting to untrusted or unverified SFTP servers until the upgrade is complete.
Review Startup folders and recently written files on hosts that connected to unknown SFTP endpoints.

Patch Information

The fix is delivered in Tabby release v1.0.235. The security patch commit introduces a resolveInsideBase() helper in tabby-electron/src/services/platform.service.ts that resolves the target path and rejects any result that escapes the base directory. The helper is invoked from both ElectronDirectoryDownload.createFile() and EditSFTPContextMenu.edit(). Full details are available in GitHub Security Advisory GHSA-59p9-8gwf-v9v7.

Workarounds

Restrict SFTP usage in Tabby to trusted, authenticated servers under organizational control.
Run Tabby under a low-privilege Windows account to limit the reach of arbitrary file writes.
Disable folder downloads and remote file editing until the client is patched.

bash

# Verify installed Tabby version on Windows via PowerShell
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Tabby*' } |
  Select-Object DisplayName, DisplayVersion

# Any DisplayVersion below 1.0.235 is vulnerable to CVE-2026-72903