CVE-2026-54591

Name of the Vulnerable Software and Affected Versions AsyncSSH versions prior to 2.23.1

Description AsyncSSH is a Python package providing an asynchronous client and server implementation of the SSHv2 protocol. A malicious SSH server can write arbitrary files on the SCP client's filesystem by sending filenames containing directory traversal sequences (../). This occurs because the parse cd args() function in scp.py returns server-provided names verbatim, and the recv files() function joins them to the destination path without enforcing the target directory boundary.

Recommendations Update to version 2.23.1.