UBUNTU-CVE-2026-102643: Medium severity ubuntu/python-asyncssh vulnerability
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.mappath() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AsyncSSHto a version that resolves this vulnerability.Fixed in 2.24.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SFTP user can exploit it. Exposure is limited to AsyncSSH SFTP servers which use SFTPServer.map_path() with a configured chroot.
What does an attacker need to send?
The attacker must supply a client path beginning with exactly two slash characters. This causes path normalization and joining to bypass the configured SFTP chroot.
What access could an attacker gain?
The attacker may read from or write to locations outside the SFTP chroot, subject to the operating-system permissions of the account running the server. Writing to suitable targets may enable code execution.
Which version contains the fix?
The issue is fixed in AsyncSSH version 2.24.1. Versions prior to 2.24.1 are affected under the described SFTP chroot configuration.