Is CVE-2026-48798 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48798 being exploited in the wild.

How severe is CVE-2026-48798?

High severity, with a CVSS score of 7.1, published 18 August 2026.

Which products and versions are affected?

SSH.NET (NuGet) <= 2025.1.0, ECOSYSTEM:introduced=0,fixed=2026.0.0.

Is there a fix for CVE-2026-48798?

Yes. SSH.NET (NuGet): upgrade to 2026.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48798 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48798?

Check whether you run SSH.NET (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48798: SSH.NET ScpClient path traversal in recursive download

Q: Which products and versions are affected?

SSH.NET (NuGet) <= 2025.1.0, ECOSYSTEM:introduced=0,fixed=2026.0.0.

Q: Is there a fix for CVE-2026-48798?

Yes. SSH.NET (NuGet): upgrade to 2026.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48798 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48798?

Check whether you run SSH.NET (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48798 · Severity: high · CVSS 7.1 · Published 2026-08-18

SSH.NET is a popular library used by developers to securely transfer files between computers. A security flaw in its file download feature allows a malicious server to trick the library into writing files to unintended locations on the user's computer, such as system configuration folders. This could allow an attacker to gain permanent access to the system, take over accounts, or run unauthorized programs if a user attempts to download a directory from a compromised server.

Technologies: SSH.NET (NuGet). Vendors: NuGet.

Quick answers

Is CVE-2026-48798 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48798 being exploited in the wild.
How severe is CVE-2026-48798?: High severity, with a CVSS score of 7.1, published 18 August 2026.
Which products and versions are affected?: SSH.NET (NuGet) <= 2025.1.0, ECOSYSTEM:introduced=0,fixed=2026.0.0.
Is there a fix for CVE-2026-48798?: Yes. SSH.NET (NuGet): upgrade to 2026.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48798 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48798?: Check whether you run SSH.NET (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

SSH.NET (NuGet): upgrade to 2026.0.0 or later

dotnet add package SSH.NET --version 2026.0.0

Technical details

A path traversal vulnerability (CWE-22) exists in the SSH.NET ScpClient.Download method during recursive directory transfers. The library fails to validate that file and directory names returned by the remote SCP server stay within the target local directory. By providing filenames containing '../' sequences or absolute paths, a malicious or compromised SCP server can overwrite arbitrary files that the client process has permission to access. This can lead to remote code execution or privilege escalation on the client host. The issue is fixed in version 2026.0.0, which implements validation to ensure constructed local paths remain within the intended destination.

Affected products

SSH.NET SSH.NET <= 2025.1.0

Identifiers

CVE-2026-48798
GHSA-q939-rpr3-3284

Timeline

2026-08-09: patched: Fix committed to repository
2026-08-12: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.