CVE-2026-113352 — uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept en…
Published: 2026-10-20 · CVSS: 7.7 · CVSS 4.0
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7