PT-2026-56578 · Ronf · Asyncssh

Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-54591

NVD

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences because parse cd args in scp.py returns server-provided names verbatim and recv files joins them to the destination path without enforcing the target directory boundary. This issue is fixed in version 2.23.1.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-54591

Produtos afetados

Asyncssh

Referências · 4

• https://github.com/ronf/asyncssh/releases/tag/v2.23.1 · Nota
• https://github.com/ronf/asyncssh/commit/d730803b8e4e94c20c7580d90f94d1e05f9f58de · Nota
• https://github.com/ronf/asyncssh/security/advisories/GHSA-2wxc-x7rj-hg8f · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-54591 · Nota de Segurança