uTox versions up to 0.18.1 expose a path traversal issue that lets a friend with the ability to send files auto‑accept the transfer and choose names that resolve outside the intended download directory. By sending file names that are absolute or contain directory traversal sequences, an attacker can overwrite critical shell startup files. Furthermore, the vulnerable code can use the supplied name to craft .ftinfo resume records that the ft_find_resumeable() routine later reads, and abuse FILE pointers to write to /proc/self/mem, which then results in code execution. The weakness is a classic directory traversal flaw (CWE-22).

All users running uTox through 0.18.1 are affected. The vulnerability is tied solely to the image and file transfer handling in the uTox application, and it affects any installation that has enabled auto‑accept of file transfers. No specific operating system or hardware variant is further identified in the advisory.

The CVSS v3 score of 7.7 places this vulnerability in the high risk range. The EPSS score is not available, and it has not yet been listed in CISA’s KEV catalog, but the potential for remote code execution via an ordinary Tox friend connection makes it a severe threat. Because the attack vector requires the victim’s application to auto‑accept a file from an attacker, an attacker only needs to be a friend or get the victim to accept a file transfer. The impact can be system compromise, persistence through startup files, or arbitrary code execution if the attacker supplies a crafted .ftinfo file that opens /proc/self/mem.