Tabby is a terminal emulator that, before version 1.0.235, allowed an attacker‑controlled SFTP server to send file names containing backslash path traversal sequences via entry.name. The application preserved these backslashes and forwarded them to Windows path joining, enabling the creation or overwriting of files outside the intended download or temporary edit directories. This can allow a malicious server to modify or replace files on the client machine, compromising integrity and possibly enabling privilege escalation if critical system files are targeted.

Vendors: Eugeny's Tabby. The vulnerability affects all releases prior to 1.0.235. Users running any version from the archive through 1.0.234 are exposed. The affected components include the SFTPSession readdir handling, the sftpPanel download logic, and the Electron directory download service.

The CVSS score is 8.1, indicating high severity, and the issue is not listed in CISA KEV. The EPSS score is not available, but the lack of listing suggests the exploit is not widely observed yet. Exploitation requires a compromised or malicious SFTP server that the user trusts, which can be a common scenario in enterprise or personal environments. Once the server delivers a traversal filename, the client writes the file outside the set download directory, having no additional authentication or privilege checks.