Listen to this Post
CVE-2026-85756 is an OS command injection vulnerability in SSH.NET, a Secure Shell library for .NET, affecting versions prior to 2026.0.0. The flaw resides in the `ScpClient` component, which performs file transfers by executing the `scp` binary on the remote server. When an application uses ScpClient, the library constructs a shell command that embeds the caller-supplied remote path directly into the command string. This command is then interpreted by the remote server’s shell.
The library provides a `RemotePathTransformation` property to control escaping behaviour, defaulting to RemotePathTransformation.DoubleQuote. This default wraps the path in double quotes, assuming this neutralises shell metacharacters. However, double-quoting does not safely quote every possible remote command interpreter. On a POSIX shell, sequences such as `$(…)` or backticks survive double-quoting and are interpreted as command substitutions. An attacker who can influence the remote path passed to `ScpClient` can craft a path containing such metacharacters, causing the shell to execute arbitrary commands as the authenticated SSH user.
Exploitation requires specific conditions. First, the remote server must be shell-based, meaning `scp` is invoked through a command interpreter rather than an internal implementation that bypasses the shell. Second, the attacker-influenced path must be crafted to defeat the quoting applied by the active IRemotePathTransformation. A path that is fully neutralised by the transformation, or a non-shell-based server, does not result in command execution. This vulnerability is inherent to running `scp` over a remote shell and is analogous to CVE-2020-15778.
The security advisory GHSA-mggc-4xg6-vcxf describes this issue. The root cause is that `ScpClient` places caller-supplied remote paths into the command used to run `scp` on the server. The default `RemotePathTransformation.DoubleQuote` cannot guarantee safety for arbitrary remote command interpreters. When an application passes an attacker-controlled path to a shell-based server, shell metacharacters not neutralised by the active transformation can execute commands as the authenticated SSH user.
The fixed release, version 2026.0.0, obsoletes the constructors that silently defaulted the path transformation and adds constructors that require an explicit IRemotePathTransformation. This forces callers to choose a transformation that suits their server and trust environment. For POSIX shells, the library provides RemotePathTransformation.ShellQuote. The legacy default (RemotePathTransformation.DoubleQuote) is unchanged for backwards compatibility. SCP is considered legacy, and SFTP, which does not involve a remote shell, is recommended where possible via SftpClient.
DailyCVE Form:
Platform: SSH.NET
Version: Prior to 2026.0.0
Vulnerability: ScpClient command injection
Severity: High
date: 2026-09-16
Prediction: 2026-08-09
What Undercode Say:
Example: vulnerable SCP upload using default DoubleQuote transformation
An attacker-controlled remote path containing command substitution
scp localfile user@host:"$(touch /tmp/pwned)/upload.txt"
In SSH.NET, the equivalent ScpClient call with default transformation
using (var scp = new ScpClient("host", "user", "password"))
{
scp.RemotePathTransformation = RemotePathTransformation.DoubleQuote; // default
scp.Upload(new FileInfo("localfile"), "$(touch /tmp/pwned)/upload.txt");
}
// Demonstrating the fix: explicit ShellQuote for POSIX shells
using (var scp = new ScpClient("host", "user", "password",
RemotePathTransformation.ShellQuote))
{
scp.Upload(new FileInfo("localfile"), "safe/path/upload.txt");
}
Exploit: (Educational Purposes!)
An attacker who can influence the remote path passed to `ScpClient` can inject shell metacharacters that survive the default double-quoting. For example, on a POSIX shell, the path `$(touch /tmp/pwned)` will be executed as a command substitution. If the application passes this path to `ScpClient.Upload` or ScpClient.Download, the shell running `scp` on the server will execute `touch /tmp/pwned` with the privileges of the authenticated SSH user.
Conceptual exploit path malicious_path = "benign/$(id>/tmp/whoami)/file.txt" The default DoubleQuote transformation wraps this in double quotes, but $() still executes on POSIX shells scp_client.Upload(local_file, malicious_path)
Protection: from this CVE
Upgrade SSH.NET to version 2026.0.0 or later. The fixed release requires an explicit `IRemotePathTransformation` in constructors, eliminating the silent default. For POSIX shells, use RemotePathTransformation.ShellQuote. When possible, replace `ScpClient` with SftpClient, which does not invoke a remote shell and is therefore not affected by this vulnerability class.
// Recommended: use SftpClient instead of ScpClient
using (var sftp = new SftpClient("host", "user", "password"))
{
sftp.UploadFile(stream, "/remote/path/file.txt");
}
Impact:
Command execution on the SSH server as the authenticated SSH user, when an application passes an attacker-influenced remote path to `ScpClient` against a shell-based server. The attacker can execute arbitrary commands, potentially leading to full compromise of the server environment depending on the privileges of the compromised account. Confidentiality, integrity, and availability are all impacted (CVSS 3.1 base score 7.5, High).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
