Tauri Filesystem Scope can be Partially Bypassed
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-668, CWE-284 and the CVSS impact.
Summary
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is possible to partially bypass the `fs` scope definition. It is not possible to traverse into arbitrary paths, as the issue is limited to neighboring files and sub folders of already allowed paths. The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters. This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime. A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. The issue has been patched in versions 1.0.7, 1.1.2 and 1.2.0. As a workaround, disable the dialog and fileDropEnabled component inside the tauri.conf.json.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tauri-apps | tauri | 1.0.0 to before 1.0.7; 1.1.0 to before 1.1.2 | 1.0.7, 1.1.2 | Patch available | CNA |
| — | Tauri (crates.io) | 1.0.0 to before 1.0.7 | 1.0.7 | Patch available | GHSA-q9wv-22m9-vhqh |
| — | Tauri (crates.io) | 1.1.0 to before 1.1.2 | 1.1.2 | Patch available | GHSA-q9wv-22m9-vhqh |
- tauri Vendortauri-apps Affected 1.0.0 to before 1.0.7; 1.1.0 to before 1.1.2 Fixed in 1.0.7, 1.1.2 Patch available CNA
- Tauri (crates.io) Vendor— Affected 1.0.0 to before 1.0.7 Fixed in 1.0.7 Patch available GHSA-q9wv-22m9-vhqh
- Tauri (crates.io) Vendor— Affected 1.1.0 to before 1.1.2 Fixed in 1.1.2 Patch available GHSA-q9wv-22m9-vhqh
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tauri:tauri:*:*:*:*:*:*:*:* | 1.0.0 to before 1.0.7; 1.1.0 to before 1.1.2 | Vulnerable | tauri-apps |
- cpe:2.3:a:tauri:tauri:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.0.7; 1.1.0 to before 1.1.2 Vulnerable ·tauri-apps
Remediation
- Fix · CNA tauri (tauri-apps) Fixed in 1.0.7, 1.1.2
- Fix · GHSA-q9wv-22m9-vhqh Tauri (crates.io) Fixed in 1.0.7 Advisory →
- Fix · GHSA-q9wv-22m9-vhqh Tauri (crates.io) Fixed in 1.1.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-41874
- 2026-10-03 Alias added: GHSA-q9wv-22m9-vhqh
References
More tauri-apps Tauri vulnerabilities
- TI-2022-18594 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri CVSS 3.1HIGH 8.3
- TI-2023-24757 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli CVSS 3.1HIGH 8.4
- TI-2022-22815 Tauri vulnerable to path traversal CVSS 3.1HIGH 7.7
- TI-2026-30506 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands CVSS 4.0MEDIUM 6.1
- TI-2023-17285 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles CVSS 3.1CRITICAL 9.8
- TI-2023-14844 Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites CVSS 3.1MEDIUM 5.4
Sources
- CVE-2022-41874 · CVE Program
- CVE-2022-41874 · NVD
- FIRST EPSS
- GHSA-q9wv-22m9-vhqh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences