SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames (CVE-2026-48798)
SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.
AI Analysis
Technical Summary
The SSH.NET library for .NET, specifically versions prior to 2026.0.0, has a directory traversal vulnerability (CWE-22, CWE-73) in the ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) method. This method trusts file and directory names from the remote SCP server without containment validation, allowing a malicious or compromised SCP server to craft filenames with '../' sequences or absolute paths. As a result, an attacker can cause the client to write or overwrite arbitrary files on the local filesystem with the privileges of the client process. The vulnerability has a CVSS 3.1 score of 7.1 (High) and is fixed in version 2026.0.0.
Potential Impact
An attacker controlling or impersonating the SCP server can exploit this vulnerability to write or overwrite arbitrary files on the client system in locations writable by the client process. This can lead to unauthorized modification of files, potentially enabling further compromise or disruption of the client environment. There is no confidentiality or availability impact directly indicated, but integrity impact is high.
Mitigation Recommendations
A fix is available in SSH.NET version 2026.0.0. Users should upgrade to this version or later to remediate the vulnerability. Until upgraded, avoid using the vulnerable ScpClient.Download method with untrusted SCP servers. Patch status is confirmed by the vendor advisory indicating the fix in version 2026.0.0.
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames (CVE-2026-48798)
Description
SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The SSH.NET library for .NET, specifically versions prior to 2026.0.0, has a directory traversal vulnerability (CWE-22, CWE-73) in the ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) method. This method trusts file and directory names from the remote SCP server without containment validation, allowing a malicious or compromised SCP server to craft filenames with '../' sequences or absolute paths. As a result, an attacker can cause the client to write or overwrite arbitrary files on the local filesystem with the privileges of the client process. The vulnerability has a CVSS 3.1 score of 7.1 (High) and is fixed in version 2026.0.0.
Potential Impact
An attacker controlling or impersonating the SCP server can exploit this vulnerability to write or overwrite arbitrary files on the client system in locations writable by the client process. This can lead to unauthorized modification of files, potentially enabling further compromise or disruption of the client environment. There is no confidentiality or availability impact directly indicated, but integrity impact is high.
Mitigation Recommendations
A fix is available in SSH.NET version 2026.0.0. Users should upgrade to this version or later to remediate the vulnerability. Until upgraded, avoid using the vulnerable ScpClient.Download method with untrusted SCP servers. Patch status is confirmed by the vendor advisory indicating the fix in version 2026.0.0.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-q939-rpr3-3284
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48798"]
- Ecosystems
- ["NuGet"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a7c9b2cbf8831d539cdb54d
Added to database: 08/12/2026, 16:11:24 UTC
Last enriched: 08/21/2026, 11:19:22 UTC
Last updated: 09/27/2026, 13:47:45 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.