Path Traversal Vulnerability in Evil-WinRM Affects Windows Servers

CVE-2026-55201

What is CVE-2026-55201?

Evil-WinRM versions prior to 3.9 contain a path traversal vulnerability in the download_dir() function. This flaw allows an attacker controlling a malicious remote Windows server to exploit the application by supplying filenames with traversal sequences that are not properly sanitized. Consequently, attackers can write files outside of the designated download directory, overwriting sensitive files on the client side, such as SSH authorized_keys or shell configuration files. This could lead to persistent access or privilege escalation on affected client machines, significantly jeopardizing security.

References