{"id":"CVE-2026-102643","published":"2026-11-09T22:18:21.920","lastModified":"2026-11-09T22:18:21.920","description":"AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22","CWE-50"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf","tags":[]},{"url":"https://github.com/ronf/asyncssh/releases/tag/v2.24.1","tags":[]},{"url":"https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9","tags":[]}],"exploitRefs":[{"url":"https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf","tags":[]},{"url":"https://github.com/ronf/asyncssh/releases/tag/v2.24.1","tags":[]},{"url":"https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9","tags":[]}],"hasPoc":true,"ai":{"summary":"In AsyncSSH versions prior to 2.24.1, the SFTPServer.map_path() method incorrectly handles client-supplied paths with double leading slashes (e.g., //path), allowing authenticated SFTP users to escape the configured chroot jail by leveraging POSIX path normalization behavior. This enables unauthorized access to the host filesystem with the server process's privileges, potentially leading to data exfiltration or remote code execution.","exploitability":"Exploitation requires valid SSH/SFTP credentials and the ability to submit a specially crafted path starting with exactly two slashes; no user interaction is needed beyond authentication.","blast_radius":"Successful exploitation grants filesystem access equivalent to the service account running the AsyncSSH server, risking full system compromise if that account has broad permissions or writable system paths.","remediation":"Upgrade AsyncSSH to version 2.24.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["chroot-bypass","sftp","path-traversal","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-10T09:48:12.360Z"}}