Path Traversal Vulnerability in Charmbracelet Wish by Charmbracelet

CVE-2026-53980

What is CVE-2026-53980?

The Charmbracelet Wish product, specifically versions prior to 2.0.5, is prone to a path traversal vulnerability within its Git middleware. This flaw enables authenticated SSH users to circumvent the designated repository directory by supplying specially crafted paths. The vulnerability arises from an inadequate forward-slash-count containment check, resulting in the potential for attackers to exploit single-depth paths like '../evil' or Windows-specific payloads such as '....\evil'. This could allow unauthorized access to read or write files across arbitrary repositories outside the secure root through commands like git-upload-pack, git-upload-archive, or git-receive-pack, thereby compromising data integrity and confidentiality.

References