Evnsh

**Name of the Vulnerable Software and Affected Versions** Wish versions 2.0.0 through 2.0.0 **Description** The SCP middleware in `charm.land/wish/v2` is subject to path traversal. A malicious SCP client can read and write arbitrary files, as well as create directories outside the configured root directory, by sending crafted filenames containing `../` sequences over the SCP protocol. This occurs because the `prefixed()` function fails to properly validate that the resolved path remains within the root directory after cleaning the path. This can be exploited through three main vectors: arbitrary file writes during file reception (`scp -t`), arbitrary file reads during file transmission (`scp -f`), and file enumeration using glob metacharacters (`*`, `?`, `[`). If the server uses default authentication that accepts all connections, these actions can be performed by unauthenticated remote attackers. **Recommendations** Update to version 2.0.1. As a temporary workaround, restrict access to the `scp.Middleware` or the `scp.NewFileSystemHandler` component to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Soft Serve versions prior to 0.11.6 **Description** An authorization flaw exists in the `repo import` functionality, allowing any authenticated SSH user to clone server-local Git repositories, including private repositories belonging to other users, into new repositories they control. This bypasses the intended confidentiality boundaries for private repositories. The issue stems from insufficient validation of the source remote during the import process. Specifically, the authorization check only verifies the destination repository name, not the source remote. The vulnerable code flow involves the `pkg/ssh/cmd/import.go`, `pkg/ssh/cmd/cmd.go`, `pkg/backend/user.go`, and `pkg/backend/repo.go` files. The `git.Clone()` function is called without verifying that the `remote` parameter is a network remote, enabling an attacker to supply a server filesystem path. This allows unauthorized access to and duplication of private repositories. **Recommendations** Upgrade to version 0.11.6 or later to address this issue.