Description

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in git.Middleware(). Attackers can use a single-depth path ../evil, or on Windows a payload ..\..\evil that defeats the slash-count guard entirely, to read or write arbitrary repositories outside the intended root via git-upload-pack, git-upload-archive, or git-receive-pack.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-06T15:17:22.100Z",
  "pubdate": "2026-11-06T15:17:22.100Z",
  "executiveSummary": "A critical path traversal vulnerability exists in the git middleware of Charmbracelet wish versions prior to 2.0.5. The vulnerability arises from an insufficient validation mechanism within the git.Middleware() function, specifically regarding the handling of repository path inputs.\nThis flaw allows an authenticated SSH user to bypass directory containment restrictions intended to lock repository access to a specific root directory. By supplying crafted repository paths containing directory traversal sequences, an attacker can access, read, or write arbitrary repositories located outside the designated root on the host filesystem.\nThe vulnerability affects systems utilizing charm.land/wish/v2 for hosting git services over SSH. The risk is significant, as it enables unauthorized access to sensitive repository data and potential code injection or modification, depending on the git commands invoked by the attacker. Successful exploitation requires an authenticated SSH session, but no additional privileges are necessary beyond that initial access. Organizations relying on wish for multi-tenant or restricted repository hosting are at high risk and should prioritize remediation.",
  "technicalDetails": "The vulnerability originates in the git.Middleware() component of the charm.land/wish/v2 library. The root cause is a flawed containment validation logic that attempts to restrict repository access by counting forward slashes within the requested repo path string. This mechanism fails to account for normalized path traversal sequences that can navigate the filesystem hierarchy.\nThe exploitation method relies on the predictable behavior of the filesystem and the middleware's reliance on a weak slash-count guard. For Linux-based environments, an attacker can supply a single-depth traversal payload such as '../evil' to break out of the intended root directory. On Windows-based deployments, the mechanism is entirely defeated by utilizing backslash-based traversal sequences (e.g., '..\\..\\evil'), which circumvent the forward-slash-count verification logic entirely.\nThe attack flow follows these steps: 1) The attacker initiates an SSH connection to the wish-powered service, establishing authenticated access. 2) The attacker sends a git command request (e.g., git-upload-pack, git-upload-archive, or git-receive-pack) containing a malicious, traversal-encoded repository path. 3) The git.Middleware() performs its flawed validation check, which incorrectly evaluates the traversal path as valid. 4) The application processes the request, treating the provided path as relative to the restricted root, thereby resolving the path to an arbitrary location on the server's filesystem. 5) The underlying git operation is executed against the attacker-specified location, leading to unauthorized read access or malicious write/modification capabilities.\nThe vulnerable component is the git middleware responsible for parsing and validating SSH-based repository requests. The vulnerability is present in all versions of charm.land/wish/v2 prior to 2.0.5. Since the vulnerability is located at the middleware layer, it impacts any application utilizing this library for SSH git hosting. Post-exploitation impact is severe, granting attackers the ability to interact with any repository or directory that the application process has permission to access, effectively breaking the intended security sandbox of the git service."
}