Path Traversal Vulnerability in AsyncSSH Package
Summary
DEBIAN-CVE-2026-45309: AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Affects python-asyncssh versions 2.10.1-1 – 2.5.0-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AsyncSSH is a Python package that provides an asynchronous client and server implementation of the SSHv2 protocol, leveraging the Python asyncio framework. It is widely used for secure shell access and file transfers in Python applications. The package's functionality includes handling SSH connections, authentication, and secure data transmission. However, prior to version 2.23.0, AsyncSSH had a vulnerability that allowed for potential path traversal attacks, which could compromise the security of systems using this package.
Vulnerability Detail
The vulnerability arises from the way AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in its configuration files during pre-authentication server config reload. This expansion uses the raw SSH username, which can include path traversal segments such as '/', '', or '..'. As a result, a server configured with AuthorizedKeysFile authorized_keys/%u could inadvertently read an authorized-keys file from outside the intended directory, allowing an attacker to authenticate using a key file of their choice. This could lead to unauthorized access to the server.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the %u token in the AuthorizedKeysFile configuration to prevent potential exploitation until you can update to the patched version. Instead, specify a fixed path to the authorized keys file that does not allow for user input.
Conclusion
The AsyncSSH package has a critical path traversal vulnerability that can lead to unauthorized access if not addressed. Users are strongly advised to update to version 2.23.0 or later to mitigate this risk. Until then, employing the suggested workaround can help reduce exposure to potential attacks.
See every vulnerability recorded for python-asyncssh →
FAQ
The vulnerability allows attackers to authenticate using unauthorized key files, potentially gaining access to sensitive systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions prior to 2.23.0 are affected by this vulnerability.
Yes, you can temporarily avoid using the %u token in the AuthorizedKeysFile configuration as a workaround.
If immediate updating is not possible, implement the workaround by specifying a fixed path for the authorized keys file.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-asyncssh.
