CVE-2026-48798

HighCVSS 7.1/10Last modified Oct 22, 2026

Description

SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-22 CWE-73

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
sshnet	SSH.NET	< 2026.0.0

References

Timeline

Published: Aug 18, 2026
Last modified: Oct 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-487997.7Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the paym CVE-2026-48809.8The Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) plugin for WordPress is vulnerable to p CVE-2026-488007.8Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in sho CVE-2026-488017.5linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public CVE-2026-488027.5python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the c CVE-2026-488047.5python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and CVE-2026-488059.1Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sand CVE-2026-488069.1Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allow CVE-2026-488079.1Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join a CVE-2026-488087.5Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward th CVE-2026-488097.5python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configura CVE-2026-48816.5In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server