DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54591: CVE-2026-54591: Arbitrary File Overwrite via Path Traversal in AsyncSSH SCP Implementation

#security #cve #cybersecurity

CVE-2026-54591: Arbitrary File Overwrite via Path Traversal in AsyncSSH SCP Implementation

Vulnerability ID: CVE-2026-54591
CVSS Score: 8.1
Published: 2026-08-26

CVE-2026-54591 is a high-severity path traversal vulnerability in AsyncSSH's SCP implementation prior to version 2.23.1. When an AsyncSSH-based SCP client connects to a malicious or compromised SSH server and performs a file transfer, the server can send crafted filenames containing relative path sequences. Because the client failed to validate these filenames before resolving the final storage path, a malicious server could write or overwrite arbitrary files on the client machine within the security context of the executing application. This vulnerability is mapped to GitHub Security Advisory GHSA-2wxc-x7rj-hg8f.

TL;DR

AsyncSSH clients prior to 2.23.1 are vulnerable to arbitrary file write and overwrite attacks if they connect to malicious SSH/SCP servers, due to unvalidated server-provided filenames containing directory traversal sequences like '../../'.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 8.1 (High)
  • EPSS Score: 0.00492
  • Impact: Arbitrary File Overwrite / Write
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • AsyncSSH client applications executing SCP file transfer operations
  • Automated network script environments utilizing raw asyncssh dependency blocks
  • Container systems implementing dynamic, third-party file retrievals via Python
  • asyncssh: < 2.23.1 (Fixed in: 2.23.1)

Code Analysis

Commit: d730803

Fix path traversal in SCP implementation by validating filenames in _parse_cd_args.

Mitigation Strategies

  • Upgrade asyncssh dependency to version 2.23.1 or greater.
  • Migrate file-transfer architectures from legacy SCP to SFTP.
  • Run SSH automated file-transfer jobs using low-privilege system accounts.
  • Enforce directory containerization or sandbox barriers around Python runtimes.

Remediation Steps:

  1. Identify and document all services running asyncssh versions prior to 2.23.1.
  2. Execute 'pip install --upgrade asyncssh>=2.23.1' in development and production environments.
  3. Refactor scp() calls to leverage SFTP-based transfer handlers for safer structural validations.
  4. Restrict execution access permissions of the runner scripts to dedicated folders, preventing parent directory modifications.

References

Read the full report for CVE-2026-54591 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)