{"id":"CVE-2026-48798","sourceIdentifier":"security-advisories@github.com","published":"2026-08-18T15:16:54.427","lastModified":"2026-10-22T22:10:00.250","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0."},{"lang":"es","value":"SSH.NET es una biblioteca Secure Shell (SSH) para .NET. En las versiones 2025.1.0 y anteriores, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) confía en los nombres de archivo y directorio devueltos por un servidor SCP remoto y los combina con el directorio local solicitado sin validación de contención, permitiendo que un servidor malicioso, comprometido o man-in-the-middle utilice secuencias .. /  o rutas absolutas para crear o sobrescribir archivos en cualquier lugar donde el proceso del cliente tenga permisos de escritura. Este problema se ha solucionado en la versión 2026.0.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sshnet","product":"SSH.NET","versions":[{"version":"< 2026.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-18T15:28:39.653141Z","id":"CVE-2026-48798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/sshnet/SSH.NET/commit/600be0de543765995a189b5d7cd4efac5007f3ce","source":"security-advisories@github.com"},{"url":"https://github.com/sshnet/SSH.NET/releases/tag/2026.0.0","source":"security-advisories@github.com"},{"url":"https://github.com/sshnet/SSH.NET/security/advisories/GHSA-q939-rpr3-3284","source":"security-advisories@github.com"}]}