Tauri vulnerable to path traversal
Priority HIGH 67CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.
Summary
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01073 65th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed tauri (tauri-apps): 1.0.8, 1.1.3, 1.2.3 +1tauri (crates.io): 1.0.8, 1.1.3, 1.2.3 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tauri-apps | tauri | 1.0.0 to before 1.0.8; 1.1.0 to before 1.1.3; 1.2.0 to before 1.2.3; 2.0.0-alpha.0 to before 2.0.0-alpha.2 | 1.0.8, 1.1.3, 1.2.3, 2.0.0-alpha.2 | Patch available | CNA |
| — | tauri (crates.io) | 1.0.0 to before 1.0.8 | 1.0.8 | Patch available | GHSA-6mv3-wm7j-h4w5 |
| — | tauri (crates.io) | 1.1.0 to before 1.1.3 | 1.1.3 | Patch available | GHSA-6mv3-wm7j-h4w5 |
| — | tauri (crates.io) | 1.2.0 to before 1.2.3 | 1.2.3 | Patch available | GHSA-6mv3-wm7j-h4w5 |
| — | tauri (crates.io) | 2.0.0-alpha.0 to before 2.0.0-alpha.2 | 2.0.0-alpha.2 | Patch available | GHSA-6mv3-wm7j-h4w5 |
- tauri Vendortauri-apps Affected 1.0.0 to before 1.0.8; 1.1.0 to before 1.1.3; 1.2.0 to before 1.2.3; 2.0.0-alpha.0 to before 2.0.0-alpha.2 Fixed in 1.0.8, 1.1.3, 1.2.3, 2.0.0-alpha.2 Patch available CNA
- tauri (crates.io) Vendor— Affected 1.0.0 to before 1.0.8 Fixed in 1.0.8 Patch available GHSA-6mv3-wm7j-h4w5
- tauri (crates.io) Vendor— Affected 1.1.0 to before 1.1.3 Fixed in 1.1.3 Patch available GHSA-6mv3-wm7j-h4w5
- tauri (crates.io) Vendor— Affected 1.2.0 to before 1.2.3 Fixed in 1.2.3 Patch available GHSA-6mv3-wm7j-h4w5
- tauri (crates.io) Vendor— Affected 2.0.0-alpha.0 to before 2.0.0-alpha.2 Fixed in 2.0.0-alpha.2 Patch available GHSA-6mv3-wm7j-h4w5
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tauri:tauri:*:*:*:*:*:*:*:* | 1.0.0 to before 1.0.8; 1.1.0 to before 1.1.3; 1.2.0 to before 1.2.3 | Vulnerable | tauri-apps |
| cpe:2.3:a:tauri:tauri:2.0.0:alpha0:*:*:*:*:*:* | 2.0.0 alpha0 | Vulnerable | tauri-apps |
| cpe:2.3:a:tauri:tauri:2.0.0:alpha1:*:*:*:*:*:* | 2.0.0 alpha1 | Vulnerable | tauri-apps |
- cpe:2.3:a:tauri:tauri:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.0.8; 1.1.0 to before 1.1.3; 1.2.0 to before 1.2.3 Vulnerable ·tauri-apps
- cpe:2.3:a:tauri:tauri:2.0.0:alpha0:*:*:*:*:*:* Versions 2.0.0 alpha0 Vulnerable ·tauri-apps
- cpe:2.3:a:tauri:tauri:2.0.0:alpha1:*:*:*:*:*:* Versions 2.0.0 alpha1 Vulnerable ·tauri-apps
Remediation
- Fix · CNA tauri (tauri-apps) Fixed in 1.0.8, 1.1.3, 1.2.3, 2.0.0-alpha.2
- Fix · GHSA-6mv3-wm7j-h4w5 tauri (crates.io) Fixed in 1.0.8 Advisory →
- Fix · GHSA-6mv3-wm7j-h4w5 tauri (crates.io) Fixed in 1.1.3 Advisory →
- Fix · GHSA-6mv3-wm7j-h4w5 tauri (crates.io) Fixed in 1.2.3 Advisory →
- Fix · GHSA-6mv3-wm7j-h4w5 tauri (crates.io) Fixed in 2.0.0-alpha.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-46171
- 2026-10-03 Alias added: GHSA-6mv3-wm7j-h4w5
References
Patch 2
More tauri-apps Tauri vulnerabilities
- TI-2022-18594 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri CVSS 3.1HIGH 8.3
- TI-2023-24757 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli CVSS 3.1HIGH 8.4
- TI-2026-30506 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands CVSS 4.0MEDIUM 6.1
- TI-2023-17285 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles CVSS 3.1CRITICAL 9.8
- TI-2023-14844 Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites CVSS 3.1MEDIUM 5.4
- TI-2022-20215 Tauri Filesystem Scope can be Partially Bypassed CVSS 3.1MEDIUM 4.7
Sources
- CVE-2022-46171 · CVE Program
- CVE-2022-46171 · NVD
- FIRST EPSS
- GHSA-6mv3-wm7j-h4w5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences