PT-2026-56578 · Ronf · Asyncssh

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-54591

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences because parse cd args in scp.py returns server-provided names verbatim and recv files joins them to the destination path without enforcing the target directory boundary. This issue is fixed in version 2.23.1.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-54591

Affected Products

Asyncssh

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-54591 · Security Note
• https://github.com/ronf/asyncssh/releases/tag/v2.23.1 · Note
• https://github.com/ronf/asyncssh/commit/d730803b8e4e94c20c7580d90f94d1e05f9f58de · Note
• https://github.com/ronf/asyncssh/security/advisories/GHSA-2wxc-x7rj-hg8f · Note