CVE-2026-102643: high-severity vulnerability in ronf asyncssh
AsyncSSH: SFTPServer Chroot Escape
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
ronf · asyncsshRelated CVEs — ronf asyncssh
In the same product, most dangerous first.
CVE-2026-45309HIGHAsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal usernameEPSS 0.6%CVE-2026-54591HIGHAsyncSSH: SCP Path Traversal to Arbitrary File WriteEPSS 0.5%CVE-2026-62949MEDIUMAsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATIONEPSS 0.4%CVE-2026-54590MEDIUMAsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansionEPSS 0.3%CVE-2026-77473MEDIUMAsyncSSH: SFTP Recursive Copy Path Traversal via Unsanitized Server-Supplied FilenamesEPSS —