Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| SSH.NET | nuget | <= 2025.1.0 | 2026.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic path traversal issue within the SSH.NET library's SCP client implementation. When a user initiates a recursive directory download using ScpClient.Download(string, DirectoryInfo), the underlying private method InternalDownload processes file and directory information sent by the SCP server. The root cause of the vulnerability is that this InternalDownload method failed to validate the file and directory names received from the server. A malicious server could send names containing path traversal sequences like ../ or absolute paths. The client code would then concatenate these malicious names with the local destination path, allowing the server to create or overwrite files anywhere on the client's filesystem that the executing process has write permissions for. The fix, shown in commit 600be0de543765995a189b5d7cd4efac5007f3ce, introduces a new validation method, EnsureValidLocalName, which is called within InternalDownload to sanitize the server-provided names before they are used to construct local paths, thus preventing the traversal.
Renci.SshNet.ScpClient.InternalDownloadsrc/Renci.SshNet/ScpClient.cs
Renci.SshNet.ScpClient.Downloadsrc/Renci.SshNet/ScpClient.cs