References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

{"timestamp":"2026-08-18T15:28:39.653141Z","id":"CVE-2026-48798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

CWE-22

CWE-73

https://github.com/sshnet/SSH.NET/commit/600be0de543765995a189b5d7cd4efac5007f3ce

https://github.com/sshnet/SSH.NET/releases/tag/2026.0.0

https://github.com/sshnet/SSH.NET/security/advisories/GHSA-q939-rpr3-3284

[{"vendor":"sshnet","product":"SSH.NET","versions":[{"version":"< 2026.0.0","status":"affected"}]}]