CVE-2026-113352: uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ftfindresumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be a Tox friend of the victim. Exploitation requires the victim to have automatic acceptance of file transfers enabled.
What access does an attacker gain?
A malicious Tox friend can supply absolute-path or ../ file names to write arbitrary files on the victim system. The described impact includes overwriting shell startup files and potentially achieving code execution through crafted .ftinfo resume records.
Are users affected if they do not enable automatic file-transfer acceptance?
The described attack path specifically requires auto-accept to be enabled. Disabling automatic acceptance prevents this stated file-transfer exploitation path.
What can be done while patching is unavailable?
Disable automatic acceptance of file transfers and review received files and file names before accepting transfers. Treat unexpected .ftinfo resume records and transfers from untrusted or compromised Tox friends as potentially malicious.