CVE-2026-53980: Charmbracelet Wish 2.0.5 Path Traversal via git Middleware
Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in git.Middleware(). Attackers can use a single-depth path ../evil, or on Windows a payload ..\..\evil that defeats the slash-count guard entirely, to read or write arbitrary repositories outside the intended root via git-upload-pack, git-upload-archive, or git-receive-pack.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
charm.land/wish/v2to a version that resolves this vulnerability.Fixed in 2.0.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Charmbracelet Wish before 2.0.5 with the git middleware enabled are exposed. The attacker must be able to authenticate to the SSH service.
What access can an attacker gain?
An authenticated SSH user can supply a crafted repository path to access repositories outside the configured repository root. Depending on the Git service invoked, this can allow reading repositories through git-upload-pack or git-upload-archive, or writing repositories through git-receive-pack.
Are Windows deployments affected differently?
Yes. On Windows, a path such as ..\..\evil can bypass the middleware's forward-slash-count containment check entirely. A single-depth ../evil path can also be used to escape the intended directory.
What should be done if an immediate update is not possible?
Restrict SSH access to trusted authenticated users and disable or avoid exposing the git middleware until an update can be applied. The provided information does not describe another mitigation that safely preserves access for untrusted SSH users.