Vulnerability in AsyncSSH Python Package Affects Remote SFTP Operations
CVE-2026-77473

6.5MEDIUM

Key Information:

Vendor

Ronf

Status
Asyncssh
Vendor
CVE Published:
9 November 2026

What is CVE-2026-77473?

The AsyncSSH package allows for asynchronous SSH communications, but prior to version 2.24.1, it is susceptible to a directory traversal vulnerability. This arises when processing remote-to-local SFTP operations, where a malicious SFTP server can return compromised file paths. Consequently, the local destination path can be manipulated to store files in unintended and potentially harmful locations. Users of AsyncSSH should update to version 2.24.1 to mitigate this risk and safeguard their file integrity against potential exploitation.

Affected Version(s)

asyncssh < 2.24.1

References

https://github.com/ronf/asyncssh/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/ronf/asyncssh/commit/eaf7fd3b058ccb36b...
x_refsource_MISC
https://github.com/ronf/asyncssh/releases/tag/v2.24.1
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.