A vulnerability has been discovered in the TeamViewer Desktop Clients which fail to sanitize filenames supplied by a remote peer before creating files on the receiving endpoint.
Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior to version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can leverage this behavior to achieve arbitrary file write and potentially execute code with the privileges of the affected user.
The vulnerability has been fixed with version 15.81.5 and additional versions listed below. We recommend updating to the latest available version.
At the time of publication, we are not aware of any prior public disclosure of this issue or any indication of exploitation in the wild.
Base Score 7.5 (High)
CVSS3.1 Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-73: External Control of File Name or Path
TeamViewer Full Client (Windows, macOS, Linux)
TeamViewer Host (Windows, macOS, Linux)
TeamViewer QuickSupport (Windows, macOS, Linux)
TeamViewer Full Client (Windows 7 & 8)
TeamViewer Host (Windows 7 & 8)
TeamViewer QuickSupport (Windows 7 & 8)
TeamViewer Portable (Windows 7 & 8)
TeamViewer Full Client (Windows) v14
TeamViewer Full Client (Linux, macOS) v14
TeamViewer Host (Windows) v14
TeamViewer Host (Linux, macOS) v14
TeamViewer QuickSupport (Windows) v14
TeamViewer QuickSupport (Linux, macOS) v14
TeamViewer Full Client (Windows) v13
TeamViewer Full Client (Linux) v13
TeamViewer Full Client (macOS) v13
TeamViewer Host (Windows) v13
TeamViewer Host (Linux) v13
TeamViewer Host (macOS) v13
Update to the latest version (15.81.5 or the latest version available)
We thank Jamir0quai & sam91281 for the discovery and responsible disclosure via TeamViewer’s Bug Bounty program.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
