A flaw in the dialog plugin of Tauri applications lets an attacker who can execute JavaScript in the renderer process force a dialog to request recursive access to a directory. The attacker supplies a recursion flag that the plugin blindly accepts, granting the application permission to read and write every file in the selected directory tree. The user sees a normal OS file dialog and has no indication that recursive permissions were granted, and once granted the expanded scope cannot be revoked for the application's lifetime. This flaw is a classic example of improper access control (CWE‑732) and results in full control over an entire directory hierarchy, potentially exposing sensitive data or allowing further local exploitation.

Any Tauri application that includes the tauri-plugin-dialog component is affected. No specific version numbers are listed in the advisory, but the issue applies to the dialog plugin as shipped with Tauri framework v2. Applications that use the dialog for file or folder selection are at risk unless the fix has been applied.

The vulnerability has a CVSS score of 7.7, indicating moderate‑to‑high severity, and an EPSS score of less than 1%, reflecting a low but non‑zero probability of exploitation. It is not yet listed in the CISA KEV catalog. Attackers would need to embed malicious JavaScript (e.g., via a cross‑site scripting vector) in the renderer to trigger the recursion flag, then prompt the user to click a standard file dialog. Once the dialog is accepted, the application receives recursive filesystem access without any revocation mechanism.