Description

SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:16:54.427Z",
  "pubdate": "2026-08-18T15:16:54.427Z",
  "executiveSummary": "SSH.NET suffers from a path traversal vulnerability residing within the ScpClient component affecting version 2025.1.0 and earlier.\nThe vulnerability allows malicious, compromised, or man-in-the-middle SSH/SCP servers to achieve arbitrary file creation or file overwrite capabilities on the client machine.\nThe flaw is triggered during recursive directory downloads when the client processes the `ScpClient.Download(string directoryName, DirectoryInfo directoryInfo)` method.\nAttackers can leverage relative path traversal sequences such as '../' or absolute paths returned directly by the remote server to escape the intended destination directory.\nThis impacts system integrity and potentially confidentiality if sensitive configuration files, binaries, or startup scripts are overwritten by the client process context.\nSuccessful exploitation requires the client to initiate a download operation from an untrusted or maliciously manipulated SCP server.\nThe issue has been officially addressed and resolved in version 2026.0.0.",
  "technicalDetails": "The root cause of this vulnerability stems from an insufficient validation and sanitization flaw within the path handling logic of the ScpClient component in SSH.NET.\nSpecifically, the vulnerable function `ScpClient.Download(string directoryName, DirectoryInfo directoryInfo)` blindly trusts file and directory names provided by the remote SCP server during file transfer operations.\nWhen a user or automated process invokes this method to download a directory structure, the SCP server dictates the relative paths and file structures of the payload.\nBecause the library fails to perform proper containment validation or boundary checks, it directly combines the malicious path strings returned by the server with the requested local directory path.\nAn attacker controlling the remote SCP server, or positioned as a man-in-the-middle intercepting the protocol traffic, can embed path traversal sequences (such as '../') or absolute filesystem paths into the metadata responses sent to the client.\nDuring step-by-step exploitation, the attack flow initiates when the client connects to the malicious SCP server and requests a recursive directory download.\nThe malicious server responds with crafted file or directory identifiers containing directory traversal payloads.\nThe client-side `ScpClient` processes these names and resolves the target path, failing to restrict the resulting file path to the designated local base directory.\nConsequently, the file write operation resolves to arbitrary locations on the host file system that are writable by the user running the client process.\nThis payload behavior results in arbitrary file creation or the overwriting of existing files outside the intended scope.\nThe vulnerable component is the SSH.NET library, specifically the `ScpClient` class and its recursive download methods in versions 2025.1.0 and earlier."
}