CVE-2026-53980

HighCVSS 8.1/10Last modified Nov 12, 2026

Description

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in git.Middleware(). Attackers can use a single-depth path ../evil, or on Windows a payload ..\..\evil that defeats the slash-count guard entirely, to read or write arbitrary repositories outside the intended root via git-upload-pack, git-upload-archive, or git-receive-pack.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 6, 2026
Last modified: Nov 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-539817.6Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary aut CVE-2026-539826.5Cap-go Console < 12.28.2 contains a denial-of-service vulnerability in its account deletion flow that allows an attacker to block authentica CVE-2026-539838.6Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuratio CVE-2026-539849.1Ground Station prior to 0.6.0 contains an unauthenticated database-destruction and arbitrary-data-injection vulnerability in the Socket.IO s CVE-2026-539857.5Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event ha CVE-2026-539865.3Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability th CVE-2026-539876.4The Tag plugin for GLPI 11 before 2.14.4 stores the tag name without HTML sanitization and renders it into the Kanban badge markup via Plugi CVE-2026-5398810.0Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attac CVE-2026-539894.7Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers CVE-2026-53996.4The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versi CVE-2026-539926.1ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to injec CVE-2026-539946.5ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the a