Executive brief
SSH.NET is a popular library used by developers to securely transfer files between computers. A security flaw in its file download feature allows a malicious server to trick the library into writing files to unintended locations on the user's computer, such as system configuration folders. This could allow an attacker to gain permanent access to the system, take over accounts, or run unauthorized programs if a user attempts to download a directory from a compromised server.
Technical details
A path traversal vulnerability (CWE-22) exists in the SSH.NET ScpClient.Download method during recursive directory transfers. The library fails to validate that file and directory names returned by the remote SCP server stay within the target local directory. By providing filenames containing '../' sequences or absolute paths, a malicious or compromised SCP server can overwrite arbitrary files that the client process has permission to access. This can lead to remote code execution or privilege escalation on the client host. The issue is fixed in version 2026.0.0, which implements validation to ensure constructed local paths remain within the intended destination.
Affected products
- SSH.NET SSH.NET <= 2025.1.0
Timeline
- 2026-08-09: patched: Fix committed to repository
- 2026-08-12: advisory: GitHub Advisory published