CVE-2026-113352
Received Received - Intake

Path Traversal in uTox Desktop Client

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113352
EUVD
EUVD-2026-104923

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
uTox uTox 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in uTox through 0.18.1 where Tox friends can write arbitrary files to a victim's system if auto-accept for file transfers is enabled. Attackers send absolute or relative paths with .. to overwrite critical files like shell startup scripts. Crafted .ftinfo files can manipulate FILE pointers to write to sensitive locations such as /proc/self/mem for potential code execution.

Detection Guidance

Check if uTox is running version 0.18.1 or earlier. Look for unexpected file writes in user directories or shell startup files. Monitor for .ftinfo or .ftoutfo files in profile directories. Review file transfer logs for absolute paths or ../ sequences in filenames.

Impact Analysis

If you use uTox 0.18.1 or earlier with auto-accept enabled, a malicious contact could overwrite system files, execute arbitrary code, or cause denial of service. This includes replacing shell startup files to gain persistent access or manipulating memory via /proc/self/mem.

Mitigation Strategies

Upgrade uTox to the latest version. Disable auto-accept for file transfers. Restrict file transfer directories to a dedicated Tox_Auto_Accept folder. Review and remove any suspicious .ftinfo or .ftoutfo files in profile directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart