CVE-2026-77473: AsyncSSH: SFTP Recursive Copy Path Traversal via Unsanitized Server-Supplied Filenames
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient.copy() in asyncssh/sftp.py, reached through get(), mget(), and copy(), trust filenames returned by a remote server's directory enumeration. A malicious or compromised SFTP server can return an absolute filename or a filename containing path separators and parent-directory traversal, causing destination path construction to escape the requested local directory and write attacker-selected content to locations writable by the client process. This issue is fixed in version 2.24.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
asyncsshto a version that resolves this vulnerability.Fixed in 2.24.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Clients using AsyncSSH versions prior to 2.24.1 are exposed when they perform recursive remote-to-local SFTP copies against a malicious or compromised SFTP server. The affected operations are reached through get(), mget(), and copy().
What does exploitation require?
An attacker needs to control, or compromise, the SFTP server used by the client and return crafted names during directory enumeration. Exploitation also requires a user to initiate a recursive download or copy, and the client process can only write to locations for which it has permissions.
Can this affect a normal recursive download destination?
Yes. Crafted absolute names, path separators, or parent-directory traversal sequences can cause files to be written outside the local directory selected for the recursive copy.
What should be done if patching cannot happen immediately?
Avoid recursive remote-to-local SFTP copies from untrusted or potentially compromised servers. Where such copies are necessary, run the client with restricted filesystem write permissions so that unintended writes have limited impact.
How can I determine whether a deployment is affected?
Check whether AsyncSSH is older than 2.24.1 and whether the application uses recursive remote-to-local get(), mget(), or copy() operations. Systems which do not perform those recursive download or copy workflows are not described as affected by this issue.