CVE-2026-102643

Full vulnerability record from the local CVENow database.

Description

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-09 22:18:21.920000

Last modified

2026-11-09 22:18:21.920000

View original CVE JSON

{
  "id": "CVE-2026-102643",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-09T22:18:21.920",
  "lastModified": "2026-11-09T22:18:21.920",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ronf",
          "product": "asyncssh",
          "versions": [
            {
              "version": "< 2.24.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-50"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ronf/asyncssh/releases/tag/v2.24.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9",
      "source": "[email protected]"
    }
  ]
}