Vulnerability · Published Sep 23, 2026 · Assigned by JFROG

CVE-2026-95627Tauri framework v2 Dialog plugin auto-expands the filesystem scope with attacker-controlled recursion

High 7.7

In plain English

A high-severity incorrect permission assignment in tauri-plugin-dialog from Tauri. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.

Affected products (as reported)

Vendor	Product	Versions
Tauri	tauri-plugin-dialog	2.0.0 – through *

Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

References

GHSA-vw89-89jm-wmqc (tauri-apps/plugins-workspace) issue-tracking
tauri-apps/plugins-workspace repository product