Read the docs
TI-2018-14689 Aliases CVE-2018-20684GHSA-j599-p537-9c5p

In WinSCP before 5.14 beta, due to missing validation, the scp implementation would…

Priority LOW 38CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.

Why it matters now

EPSS 0.02768 86th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*up to 5.13.7VulnerableWinscp
  • cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:* Versions up to 5.13.7 Vulnerable ·Winscp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-20684
  2. 2026-10-03 Alias added: GHSA-j599-p537-9c5p

References

Patch 2

Advisory 2

Other 1

  • TI-2002-01283 Multiple SSH2 servers and clients do not properly handle large packets or large fields… CVSS 2.0HIGH 10.0
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2019-04326 In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server… CVSS 3.1MEDIUM 6.8
  • TI-2019-04327 An issue was discovered in OpenSSH 7.9. CVSS 3.1MEDIUM 5.9
  • TI-2021-02333 WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL… CVSS 3.1CRITICAL 9.8
  • TI-2002-01281 Multiple SSH2 servers and clients do not properly handle packets or data elements with… CVSS 2.0HIGH 10.0
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences