CVE-2026-77473

Name of the Vulnerable Software and Affected Versions AsyncSSH versions prior to 2.24.1

Description Recursive remote-to-local SFTP copies in the SFTPClient. copy() function within asyncssh/sftp.py, accessible via get(), mget(), and copy(), trust filenames provided by a remote server's directory enumeration. A compromised or malicious SFTP server can return absolute filenames or filenames containing path separators and parent-directory traversal. This allows the destination path construction to escape the intended local directory, enabling the server to write arbitrary content to any location writable by the client process.

Recommendations Update AsyncSSH to version 2.24.1.