Listen to this Post
This vulnerability, tracked as CVE-2026-54591, affects all versions of the AsyncSSH library up to and including 2.23.0. The flaw resides in the SCP client implementation, where a malicious SSH server can exploit path traversal to write arbitrary files on the client’s filesystem. The vulnerability arises because the AsyncSSH SCP receive path does not sanitize filenames provided by the server, allowing directory traversal sequences like ../. The server sends filenames such as `C0644 100 ../pwned.txt` or uses the `D` (directory) action to traverse up the directory tree. The client-side function `_parse_cd_args` returns the filename verbatim without passing it through `basename()` or checking for `..` components. The `_recv_files` function joins this unsanitized name with the destination path, allowing the write to occur outside the intended directory. The `_recv_file` function opens the traversed path and writes arbitrary content. By chaining directory traversals, an attacker can escape the target directory and overwrite critical files such as ~/.bashrc, ~/.profile, ~/.ssh/rc, or ~/.ssh/authorized_keys. This can lead to remote code execution when the user opens a terminal, logs in, or initiates an SSH connection. The vulnerability class is the same as CVE-2019-6111 in OpenSSH, but the mitigation applied in OpenSSH was not adopted in AsyncSSH. The issue was patched in version 2.23.1, and users are strongly urged to update immediately.
DailyCVE Form:
Platform: AsyncSSH <2.23.0
Version: Through 2.23.0
Vulnerability: Path Traversal
Severity: Critical
date: 2026-08-01
Prediction: 2026-08-15
What Undercode Say:
Proof of Concept (PoC) Commands
docker build -t asyncssh-scp-traversal -f Dockerfile . docker run --rm asyncssh-scp-traversal
Vulnerability Analysis (Code Snippet)
def _parse_cd_args(args: bytes) -> Tuple[int, int, bytes]: permissions, size, name = args.split(None, 2) return int(permissions, 8), int(size), name no sanitization def _recv_files(self, srcpath: bytes, dstpath: bytes): new_dstpath = posixpath.join(dstpath, name) susceptible to path traversal
Exploit Simulation Commands
Start malicious server
python3 poc_scp_traversal.py
Client download (vulnerable)
python3 -c "import asyncio, asyncssh; asyncio.run(asyncssh.scp(('conn', 'file'), '/home/user/downloads/'))"
Log Evidence (Expected Output)
Writing file: /home/user/downloads/pwned.txt Writing file: /home/user/.bashrc Traversal successful
Exploit: (Educational Purposes!)
- Server sends `C0644 100 ../pwned.txt` to escape target directory.
- Chaining `D0755 0 ..` navigates up multiple levels.
- Overwrites `~/.bashrc` with malicious code to execute on terminal start.
- Achieves code execution by targeting `~/.ssh/authorized_keys` with a forced command.
Protection:
- Upgrade to AsyncSSH version 2.23.1 or later.
- Implement filename sanitization using
os.path.basename. - Validate `dstpath` against the original target directory path.
Impact:
- Remote Code Execution (RCE) via arbitrary file write.
- Privilege escalation through overwriting critical configuration files.
- Complete compromise of user accounts on the client system.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
