# CVE-2026-41589: Charmbracelet Wish path traversal in SCP middleware

Source: https://junglewise.ai/threats/cve-2026-41589-charmbracelet-wish-path-traversal-in-scp-middleware  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-41589 · Severity: critical · CVSS 9.6 · Published 2026-05-07

Wish is a library used to build custom SSH servers in Go. A security flaw in its SCP (Secure Copy) component allows users to bypass directory restrictions. An attacker with basic login access could read or write any file on the server's filesystem, potentially leading to full system takeover or the theft of sensitive data like passwords and private keys.

Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-41589 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41589 being exploited in the wild.

**How severe is CVE-2026-41589?** Critical severity, with a CVSS score of 9.6, published 7 May 2026.

**Which products and versions are affected?** charm.land/wish/v2 (Go) SEMVER:introduced=0,fixed=2.0.1; github.com/charmbracelet/wish (Go) SEMVER:introduced=0,last_affected=1.4.7.

**Is there a fix for CVE-2026-41589?** Yes. charm.land/wish/v2 (Go): upgrade to 2.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41589 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41589?** Check whether you run Charm Wish, charm.land/wish/v2 (Go) or github.com/charmbracelet/wish (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- charm.land/wish/v2 (Go): upgrade to 2.0.1 or later

  ```sh
  go get charm.land/wish/v2@v2.0.1
  ```


## Technical details

A path traversal vulnerability exists in the SCP middleware of the Wish SSH server library. The root cause is located in the fileSystemHandler.prefixed() method within scp/filesystem.go, which uses filepath.Clean and filepath.Join without verifying that the resulting path remains within the designated root directory. An attacker can exploit this by providing filenames containing '../' sequences during SCP operations. This allows for three primary attack vectors: arbitrary file writes (scp -t), arbitrary file reads (scp -f), and file enumeration via globbing. Successful exploitation can lead to remote code execution if the attacker overwrites sensitive files like authorized_keys or system configuration files. The issue is fixed in version 2.0.1.

## Affected products

- Charmbracelet Wish 2.0.0 to 2.0.1

## Identifiers

- CVE-2026-41589
- GHSA-xjvp-7243-rg9h
- GO-2026-5762

## Timeline

- 2026-04-17: patched: Version 2.0.1 released to address the vulnerability.
- 2026-05-07: disclosed: Vulnerability publicly disclosed and CVE assigned.

## References

- [https://github.com/charmbracelet/wish/releases/tag/v2.0.1](https://github.com/charmbracelet/wish/releases/tag/v2.0.1)
- [https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h](https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h)