CVE-2026-54591: asyncssh SCP Path Traversal Vulnerability Leading to Arbitrary File Write
Summary
CVE-2026-54591: asyncssh has SCP Path Traversal to Arbitrary File Write. Affects asyncssh versions < 2.23.1. Fixed in 2.23.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
asyncssh is a Python library that provides an asynchronous SSH and SCP client and server implementation. It allows developers to easily integrate SSH functionality into their applications, enabling secure file transfers and remote command execution. However, all versions of asyncssh up to 2.23.0 are vulnerable to a path traversal issue that can be exploited by a malicious SSH server.
Vulnerability Detail
The vulnerability arises from the lack of sanitization of server-provided filenames in the SCP receive path. An attacker can exploit this by sending filenames with '..' traversal sequences, allowing them to write arbitrary files on the client's filesystem. This can lead to severe consequences, including overwriting critical files like .bashrc or .ssh/authorized_keys, potentially resulting in remote code execution. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
How To Fix
Latest published version: 2.24.1 as of 23 Oct 2026
pip install --upgrade "asyncssh==2.24.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.23.1
This is the first release that contains the fix.
pip install --upgrade "asyncssh==2.23.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using asyncssh for SCP operations with untrusted SSH servers until you can update to the patched version. Additionally, you can implement your own filename sanitization before passing filenames to asyncssh.
Conclusion
The asyncssh package has a critical vulnerability (CVE-2026-54591) that allows for path traversal and arbitrary file writes. Users are strongly advised to update to version 2.23.1 or later to mitigate this risk. For ongoing monitoring of open-source vulnerabilities, consider using Vulert, which provides real-time alerts without requiring code access.
See every vulnerability recorded for asyncssh →
FAQ
CVE-2026-54591 is a vulnerability in asyncssh that allows a malicious SSH server to exploit path traversal to write arbitrary files on the client's filesystem.
If you are using asyncssh versions prior to 2.23.1, your application is vulnerable. You can check your application's dependencies using tools like Vulert.
The vulnerability can lead to unauthorized file writes, which may allow attackers to execute arbitrary code on the affected system.
While the best solution is to update to the patched version, you can temporarily avoid using asyncssh for SCP operations with untrusted servers.
You can find more details in the official advisory on GitHub or by using Vulert to monitor for vulnerabilities in your open-source dependencies.
References
Related vulnerabilities
Recent vulnerabilities recorded for asyncssh.
