CVE-2026-72903

creationtimestamp| type| source ---|---|--- 2026-08-10 22:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msr3yfnwhf2h...

CVE-2026-72903

Tabby (formerly Terminus) has a Windows path traversal issue tracked as CVE-2026-72903. In affected builds prior to 1.0.235, the SFTP flow preserves backslashes and relative traversal when handling filenames returned by a malicious SFTP server. Specifically, SFTPSession.readdir() and _makeFile() ...