HIGH 7.1 GitHub
CVE-2026-48798
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
## Summary
`ScpClient.Download(string directoryName, DirectoryInfo directoryInfo)` writes files and directories using names returned by the remote SCP server during recursive downloads, with no validation that the resulting path stays inside the requested local directory. A malicious, compromised, or man-in-the-middle SCP server can return names containing `../` sequences (or absolute paths), causing the client to create directories and write/overwrite files anywhere the client process has acce
Affected Products
- nuget/SSH.NET <= 2025.1.0
References
- https://github.com/advisories/GHSA-q939-rpr3-3284
- https://github.com/sshnet/SSH.NET/security/advisories/GHSA-q939-rpr3-3284
- https://github.com/sshnet/SSH.NET/commit/600be0de543765995a189b5d7cd4efac5007f3ce
- https://github.com/advisories/GHSA-q939-rpr3-3284
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-08-12 via GitHub. Affected: nuget/SSH.NET <= 2025.1.0.
vulnfeed aggregates 10467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.