Path Traversal Vulnerability in AsyncSSH by Ronny P. Frenzen

CVE-2026-102643

What is CVE-2026-102643?

A vulnerability exists in AsyncSSH versions prior to 2.24.1 that allows authenticated SFTP users to bypass the configured chroot. This occurs due to a mishandling of client-supplied paths, specifically when paths begin with double leading slashes. The path normalization process does not correctly strip these slashes, causing the subsequent join operation to treat the remainder of the path as absolute. Consequently, this can grant unauthorized file access and potentially permit code execution depending on the writable targets available to the server's operating system account.

References