TI-2026-39425 Aliases CVE-2026-54591 GHSA-2wxc-x7rj-hg8f

AsyncSSH: SCP Path Traversal to Arbitrary File Write

LOW 36CWE-22Published 2026-07-08 · Updated 2026-07-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.1, a malicious SSH server can write arbitrary files on the asyncssh SCP client's filesystem by sending filenames containing ../ traversal sequences because _parse_cd_args in scp.py returns server-provided names verbatim and _recv_files joins them to the destination path without enforcing the target directory boundary. This issue is fixed in version 2.23.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00492 42nd percentileScored 2026-11-07

Fix Fixed asyncssh (ronf): 2.23.1asyncssh (PyPI): 2.23.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ronf	asyncssh	before 2.23.1	2.23.1	Patch available	CNA
—	asyncssh (PyPI)	before 2.23.1	2.23.1	Patch available	GHSA-2wxc-x7rj-hg8f

asyncssh Vendorronf Affected before 2.23.1 Fixed in 2.23.1 Patch available CNA
asyncssh (PyPI) Vendor— Affected before 2.23.1 Fixed in 2.23.1 Patch available GHSA-2wxc-x7rj-hg8f

Remediation

Fix · CNA asyncssh (ronf) Fixed in 2.23.1
Fix · GHSA-2wxc-x7rj-hg8f asyncssh (PyPI) Fixed in 2.23.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-54591
2026-10-03 Alias added: GHSA-2wxc-x7rj-hg8f

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-54591

Other 4

TI-2026-39424 AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion CVSS 3.1MEDIUM 5.9
TI-2026-44984 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences