CVE-2026-48798

Name of the Vulnerable Software and Affected Versions SSH.NET versions prior to 2026.0.0

Description An issue exists where the ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) function trusts file and directory names provided by a remote SCP server during recursive downloads. Because the library fails to validate that the resulting paths remain within the requested local directory, a malicious, compromised, or man-in-the-middle server can use absolute paths or ../ sequences (directory traversal) to create or overwrite files anywhere the client process has write permissions. This could potentially lead to persistence, privilege escalation, or remote code execution if critical files like shell configuration or application binaries are overwritten.

Recommendations Update to version 2026.0.0. As a temporary workaround, avoid using the ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) function when connecting to untrusted servers.