# Finding 3: Path Traversal in File Transfer (HIGH)
**CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)**
**Affected:** All platforms (code is in shared `src/vdagent/file-xfers.c`)
**Attack vector:** Malicious SPICE host
## Root Cause
`src/vdagent/file-xfers.c:138-139`:
```c
task->file_name = g_key_file_get_string(keyfile,
"vdagent-file-xfer", "name", &error);
```
`src/vdagent/file-xfers.c:190`:
```c
file_path = g_build_filename(save_dir, *file_name_p, NULL);
```
The filename received from the SPICE host in file transfer metadata is used
directly in `g_build_filename()` without any sanitization.
`g_build_filename()` has a documented behavior: when the second argument is
an absolute path (starts with `/`), the first argument (`save_dir`) is
silently discarded:
```
save_dir = "/home/user/Downloads"
file_name = "/etc/cron.d/evil"
g_build_filename(save_dir, file_name, NULL) = "/etc/cron.d/evil"
```
Additionally, `..` components in relative paths are not stripped:
```
file_name = "../../etc/cron.d/evil"
result = "/home/user/Downloads/../../etc/cron.d/evil"
= "/etc/cron.d/evil" (after path resolution)
```
## Impact
A malicious SPICE host can write arbitrary files at arbitrary paths on the
guest filesystem, with the privileges of the spice-vdagent process
(typically the logged-in user, or root if running as the daemon).
Attack scenarios:
- Write to `/etc/cron.d/` for persistent code execution
- Write to `~/.ssh/authorized_keys` for SSH access
- Write to `~/.bashrc` for login-triggered command execution
- Overwrite system configuration files
## Suggested Fix
```c
// Reject absolute paths
if (file_name[0] == '/' || file_name[0] == '\\') {
syslog(LOG_ERR, "file-xfer: rejecting absolute path: %s", file_name);
return;
}
// Reject path traversal components
if (strstr(file_name, "..")) {
syslog(LOG_ERR, "file-xfer: rejecting path traversal: %s", file_name);
return;
}
// Strip directory components entirely (basename only)
char *base = strrchr(file_name, '/');
if (base) file_name = base + 1;
```
## Author
Ashish Kunwar (@D0rkerDevil) — [email protected]
