Path Traversal Vulnerability in uTox Affected by File Transfer Features

CVE-2026-113352

What is CVE-2026-113352?

uTox versions up to 0.18.1 have a path traversal vulnerability that allows attackers to leverage the auto-accept feature of file transfers. By sending specifically crafted absolute or relative file paths, malicious actors can manipulate friends on the platform into overwriting important files, such as shell startup scripts. This vulnerability can also be exploited to insert malicious resume records, which can lead to arbitrary code execution by abusing file pointers in memory. This security flaw emphasizes the need for careful file handling and transfer protocols in peer-to-peer applications.

References