CVE-2026-54591

{
  "id": "CVE-2026-54591",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T21:16:49.657",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences because _parse_cd_args in scp.py returns server-provided names verbatim and _recv_files joins them to the destination path without enforcing the target directory boundary. This issue is fixed in version 2.23.1."
    },
    {
      "lang": "es",
      "value": "AsyncSSH es un paquete de Python que proporciona una implementación asíncrona de cliente y servidor del protocolo SSHv2 sobre el framework asyncio de Python. Antes de la versión 2.23.1, un servidor SSH malicioso puede escribir archivos arbitrarios en el sistema de archivos del cliente SCP de asyncssh enviando nombres de archivo que contienen secuencias de recorrido ’.. / ’ porque _parse_cd_args en scp.py devuelve los nombres proporcionados por el servidor textualmente y _recv_files los une a la ruta de destino sin hacer cumplir el límite del directorio de destino. Este problema está solucionado en la versión 2.23.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ronf",
          "product": "asyncssh",
          "versions": [
            {
              "version": "< 2.23.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-09T14:21:05.079234Z",
          "id": "CVE-2026-54591",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ronf/asyncssh/commit/d730803b8e4e94c20c7580d90f94d1e05f9f58de",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ronf/asyncssh/releases/tag/v2.23.1",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ronf/asyncssh/security/advisories/GHSA-2wxc-x7rj-hg8f",
      "source": "[email protected]"
    }
  ]
}