CVE Intelligence

uTox vulnerabilities

🔔 Create alert RSS

Published CVEs affecting uTox products: 1 record(s), with severity, exploitation and fixes.

uTox 1

Exploited only (KEV) →

CVE-2026-113352 High · 7.5 CWE-22 Oct 20, 2026
uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.