The SCP middleware in charmbracelet wish versions from 2.0.0 to before 2.0.1 is vulnerable to CWE-22 path traversal. An attacker controlling an SCP client can exploit this by sending specially crafted filenames containing directory traversal sequences (../) to escape the configured root directory. This enables unauthorized reading and writing of arbitrary files and creation of directories outside the restricted path. The issue was addressed and fixed in version 2.0.1 of wish.

Successful exploitation allows an attacker with SCP client access and at least limited privileges to read sensitive files, write arbitrary files, and create directories outside the intended root directory on the server. This can lead to confidentiality and integrity breaches. The vulnerability does not affect availability. There are no known exploits in the wild at this time.

Upgrade charmbracelet wish to version 2.0.1 or later, where this path traversal vulnerability has been patched. Since this is a software vulnerability with an available fixed version, applying the official update is the recommended remediation. Patch status is confirmed by the vendor advisory stating the fix is included in version 2.0.1.