CVE-2022-41874

CVE-2022-41874 is a medium-severity vulnerability affecting Tauri versions prior to 1.0.7 and 1.1.2, allowing for a partial bypass of file system scope definitions. This "Incorrectly-Resolved Name" issue stems from improper escaping of special characters in paths selected via file dialogs or drag-and-drop. Exploitation requires user interaction to select a malicious file or directory, enabling an attacker to access neighboring files and subfolders of already permitted paths. While not actively exploited and lacking public exploit code, the vulnerability has been patched in newer versions, and disabling dialog and fileDropEnabled components serves as a workaround.