{"id":"EUVD-2026-28370","enisaUuid":"f3b84718-cfce-3e55-abf3-d338fce15dce","description":"Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.","datePublished":"May 7, 2026, 1:17:58 PM","dateUpdated":"May 7, 2026, 2:41:57 PM","baseScore":9.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h\nhttps://github.com/charmbracelet/wish/releases/tag/v2.0.1\n","aliases":"CVE-2026-41589\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"ae196adc-16eb-37f9-a66e-f61943d43ce2","product":{"name":"wish","vendor":{"name":"charmbracelet"}},"product_version":"2.0.0, \u003c 2.0.1"}],"enisaIdVendor":[{"id":"53156651-0496-3d25-9e95-524343e237da","vendor":{"name":"charmbracelet"}}],"enisaIdVulnerability":[{"id":"a4b3cf71-4e82-3606-b7ea-363cd8c49614","vulnerability":{"id":"CVE-2026-41589","description":"Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.","datePublished":"May 7, 2026, 1:17:58 PM","dateUpdated":"May 7, 2026, 2:41:57 PM","status":"PUBLISHED","baseScore":9.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h\nhttps://github.com/charmbracelet/wish/releases/tag/v2.0.1\n","enisa_id":"EUVD-2026-28370\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"5a660186-f492-370f-ac52-42d3506ca14c","product":{"name":"wish","vendor":{"name":"charmbracelet"}},"product_version":"2.0.0, \u003c 2.0.1"}],"vulnerabilityVendor":[{"id":"e76be51f-0c33-340c-bbaa-a17921aed717","vendor":{"name":"charmbracelet"}}]}}],"enisaIdAdvisory":[]}