CVE-2026-54336: JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset
JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath() in pkg/srvconn/sftpasset.go to resolve paths outside the intended SFTP root and permit read, list, write, rename, or delete operations under the configured backend account on that asset. This issue is fixed in version 4.10.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JumpServerto a version that resolves this vulnerability.Fixed in 4.10.17
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54336?
The severity of CVE-2026-54336 is medium with a CVSS score of 5.4.
How do I fix CVE-2026-54336?
To fix CVE-2026-54336, update JumpServer to version 4.10.17 or later.
Who is affected by CVE-2026-54336?
CVE-2026-54336 affects authenticated users with SFTP permissions in JumpServer versions from 4.8.0 to 4.10.17.
What type of vulnerability is CVE-2026-54336?
CVE-2026-54336 is classified as a path traversal vulnerability.
What is the impact of CVE-2026-54336?
The impact of CVE-2026-54336 allows an attacker to traverse directories and access unintended files on the server.