PT-2026-44151 · Pypi+1 · Asyncssh+1
Published
2026-05-27
·
Updated
2026-06-16
·
CVE-2026-45309
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P |
Name of the Vulnerable Software and Affected Versions
asyncssh versions 2.22.0 through 2.23.0
Description
An issue exists during pre-authentication server configuration reload where the
%u token in the AuthorizedKeysFile setting is expanded using the raw SSH username without rejecting path separators or .. segments. This allows a remote attacker to use path traversal in the username to force the server to read an authorized-keys file from a location outside the intended directory. If the attacker can reference or place a readable file in the authorized-keys format containing their public key, they can successfully authenticate over SSH as the traversal username.Recommendations
Update to version 2.23.1 or later.
As a temporary workaround, ensure the application rejects usernames containing
/, ``, or .. before they are processed for key-file selection.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Asyncssh
Python-Asyncssh