CVE-2026-41589: Wish has SCP Path Traversal that allows arbitrary file read/write
Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41589?
CVE-2026-41589 is considered a critical vulnerability due to its potential for arbitrary file read/write exploitations.
How do I fix CVE-2026-41589?
To fix CVE-2026-41589, upgrade to Wish version 2.0.1 or later.
What caused CVE-2026-41589?
CVE-2026-41589 was caused by a path traversal vulnerability in the SCP middleware of Wish versions 2.0.0 to before 2.0.1.
Who is affected by CVE-2026-41589?
CVE-2026-41589 affects users of Wish from version 2.0.0 to before version 2.0.1.
What types of attacks can exploit CVE-2026-41589?
CVE-2026-41589 can be exploited through path traversal attacks, allowing malicious SCP clients to access arbitrary files.