Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode…
Priority MEDIUM 47CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 2 fixed, 9 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
Why it matters now
EPSS 0.24143 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial com.jcraft:jsch (Maven): 0.1.54Red Hat: 1 advisoryRed Hat: 2 fixed, 9 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | com.jcraft:jsch (Maven) | before 0.1.54 | 0.1.54 | Patch available | GHSA-q446-82vq-w674 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- com.jcraft:jsch (Maven) Vendor— Affected before 0.1.54 Fixed in 0.1.54 Patch available GHSA-q446-82vq-w674
Remediation
- Fix · GHSA-q446-82vq-w674 com.jcraft:jsch (Maven) Fixed in 0.1.54 Advisory →
Red Hat 1 advisory
- RHSA-2017:3115 Released 2017-11-02 · Red Hat rating ModerateRed Hat JBoss Fuse/A-MQ 6.3 R5 security and bug fix update
- Red Hat JBoss A-MQ 6.3
- Red Hat JBoss Fuse 6.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Virtualization 4 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.3 | Fixed | RHSA-2017:3115 |
| Red Hat JBoss Fuse 6.3 | Fixed | RHSA-2017:3115 |
Not affected: 5 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss Operations Network 3
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2016-5725
- 2026-10-03 Alias added: GHSA-q446-82vq-w674
References
Exploit 1
Advisory 5
- 20160921 CVE-2016-5725 - JCraft/JSch Java Secure Channel <= 0.1.53 recursive sftp-get path traversal (client-side, windows)
- RHSA-2017:3115
- http://packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.html
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725
- https://nvd.nist.gov/vuln/detail/CVE-2016-5725
Other 6
- [debian-lts-announce] 20200425 [SECURITY] [DLA 2184-1] jsch security update
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://www.jcraft.com/jsch/ChangeLog
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.exploit-db.com/exploits/40411
Sources
- CVE-2016-5725 · CVE Program
- CVE-2016-5725 · NVD
- FIRST EPSS
- GHSA-q446-82vq-w674 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-5725 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences