CVE-2026-55201 is a path traversal vulnerability in Hackplayers evil-winrm through version 3.9. The issue exists in the download_dir() function, where filenames returned by the Get-ChildItem command on a remote Windows server are passed unsanitized to File.join(). This allows an attacker controlling the remote server to craft filenames containing directory traversal sequences, causing files to be written outside the intended download directory on the client side. This can lead to overwriting critical client files like SSH authorized_keys or shell configuration files, facilitating persistent access or privilege escalation.

An attacker controlling a remote Windows server can exploit this vulnerability to write arbitrary files outside the intended directory on the client machine. This can result in overwriting sensitive files such as SSH authorized_keys or shell configuration files, potentially allowing the attacker to maintain persistent access or escalate privileges on the client system.

A fix for this vulnerability has been implemented in a commit identified as 6ecd570. Users should upgrade to a version later than 3.9 where this fix is included. Patch status is not explicitly confirmed in the vendor advisory, so users should verify the presence of the fix in their version or apply the patch from the referenced commit.