CVE-2026-102643

Name of the Vulnerable Software and Affected Versions AsyncSSH versions prior to 2.24.1

Description An authenticated SFTP user can bypass the SFTP chroot by providing a path that begins with exactly two slash characters. This occurs because the SFTPServer.map path() function uses posixpath.normpath() on the client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. Consequently, POSIX normalization preserves the double-leading-slash form, causing the subsequent join to treat the pathname as absolute. This allows the user to perform reads and writes using the operating-system permissions of the account running the server, which could potentially lead to code execution depending on the writable targets.

Recommendations Update to version 2.24.1.