CVE-2026-113352

HIGH 7.5

uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.

CWE	CWE-22
Vendor	utox
Product	utox
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for utox utox

Be the first to know when new high vulnerabilities affecting utox utox are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

uTox / uTox

0 ≤ 0.18.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/uTox/uTox/issues/1587 github.com: https://github.com/uTox/uTox/pull/1602 github.com: https://github.com/uTox/uTox/pull/1603 github.com: https://github.com/uTox/uTox/blob/4b014491560c884b556f082d4d34c5229228bbc5/src/xlib/filesys.c#L191-L214 github.com: https://github.com/uTox/uTox/blob/4b014491560c884b556f082d4d34c5229228bbc5/src/file_transfers.c#L249-L290 github.com: https://github.com/uTox/uTox vulncheck.com: https://www.vulncheck.com/advisories/utox-through-0.18.1-path-traversal-via-auto-accepted-file-transfers

Credits

aby860