Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath() in pkg/srvconn/sftp_asset.go to resolve paths outside the intended SFTP root and permit read, list, write, rename, or delete operations under the configured backend account on that asset. This issue is fixed in version 4.10.17.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-17T21:16:45.930Z",
  "pubdate": "2026-08-17T21:16:45.930Z",
  "executiveSummary": "JumpServer versions 4.8.0 through 4.10.16 are affected by a path traversal vulnerability in the KoKo Web Terminal SFTP feature, which allows authenticated users with SFTP permissions on an authorized asset to access the underlying filesystem outside the intended boundaries.\nThe vulnerability stems from improper path resolution within the AssetDir.GetRealPath() function located in pkg/srvconn/sftp_asset.go, where specially crafted traversal paths are not adequately sanitized.\nSuccessful exploitation grants the attacker the ability to execute unauthorized read, list, write, rename, and delete operations across the filesystem of the targeted asset under the context of the configured backend account.\nTo exploit this issue, an attacker must possess authenticated access with explicit SFTP permissions to an authorized asset.\nThe risk implication is significant unauthorized access and potential data compromise or manipulation on managed assets.\nThe vulnerability has been addressed and fixed in version 4.10.17.",
  "technicalDetails": "The vulnerability resides in JumpServer, specifically within the KoKo Web Terminal SFTP feature handling routine.\nThe vulnerable component is identified as the AssetDir.GetRealPath() function implemented in the source file pkg/srvconn/sftp_asset.go.\nThe root cause of the vulnerability is the failure to properly sanitize and validate input containing directory traversal sequences before resolving paths against the intended SFTP root directory.\nAffected versions span from 4.8.0 up to and including 4.10.16.\nPrerequisites for exploitation include authentication and specific SFTP permission to an authorized asset.\nThe attack flow proceeds as follows: an authenticated user with authorized SFTP access submits specially crafted traversal paths via the KoKo Web Terminal SFTP feature.\nWhen processing the request, the vulnerable AssetDir.GetRealPath() function incorrectly resolves the provided traversal sequences, allowing the path resolution mechanism to escape the restricted SFTP root directory.\nThis flawed resolution logic maps the path to locations outside the intended operational boundary on the target asset.\nConsequently, the backend service permits standard file and directory operations—including read, list, write, rename, and delete actions—to be performed outside the intended directory scope.\nThe post-exploitation impact is bound by the permissions of the configured backend account utilized by the SFTP service on the affected asset, enabling unauthorized data access and modification."
}