{"id":"EUVD-2026-60945","enisaUuid":"b3e842cf-f2fe-30a1-a9bb-4b244c15c806","description":"SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.","datePublished":"Aug 18, 2026, 2:57:05 PM","dateUpdated":"Aug 18, 2026, 3:28:45 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","references":"https://github.com/sshnet/SSH.NET/security/advisories/GHSA-q939-rpr3-3284\nhttps://github.com/sshnet/SSH.NET/commit/600be0de543765995a189b5d7cd4efac5007f3ce\nhttps://github.com/sshnet/SSH.NET/releases/tag/2026.0.0\n","aliases":"CVE-2026-48798\nGHSA-q939-rpr3-3284\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"c80a587e-4dce-3943-92fe-0196e1856810","product":{"name":"SSH.NET","vendor":{"name":"sshnet"}},"product_version":"\u003c 2026.0.0"}],"enisaIdVendor":[{"id":"a25e0975-a73f-320c-a411-93a7e41b993d","vendor":{"name":"sshnet"}}],"enisaIdVulnerability":[{"id":"4f8be607-0516-3ac1-96a5-841f8305d07a","vulnerability":{"id":"GHSA-q939-rpr3-3284","description":"SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames","datePublished":"Aug 12, 2026, 3:19:10 PM","dateUpdated":"Aug 18, 2026, 6:05:07 PM","baseScore":0.0,"references":"https://github.com/sshnet/SSH.NET/security/advisories/GHSA-q939-rpr3-3284\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48798\nhttps://github.com/sshnet/SSH.NET/commit/600be0de543765995a189b5d7cd4efac5007f3ce\nhttps://github.com/sshnet/SSH.NET\nhttps://github.com/sshnet/SSH.NET/releases/tag/2026.0.0\n","enisa_id":"EUVD-2026-60945\n","aliases":"GHSA-q939-rpr3-3284\nCVE-2026-48798\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e492d48e-9c27-3f74-90ef-9b4608a5e437","vulnerability":{"id":"CVE-2026-48798","description":"SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.","datePublished":"Aug 18, 2026, 2:57:05 PM","dateUpdated":"Aug 18, 2026, 3:28:45 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","references":"https://github.com/sshnet/SSH.NET/security/advisories/GHSA-q939-rpr3-3284\nhttps://github.com/sshnet/SSH.NET/commit/600be0de543765995a189b5d7cd4efac5007f3ce\nhttps://github.com/sshnet/SSH.NET/releases/tag/2026.0.0\n","enisa_id":"EUVD-2026-60945\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Nov 1, 2026, 7:19:35 AM","vulnerabilityProduct":[{"id":"d1b8e4fc-fe97-3bd4-812b-d3ce33779eab","product":{"name":"SSH.NET","vendor":{"name":"sshnet"}},"product_version":"\u003c 2026.0.0"}],"vulnerabilityVendor":[{"id":"5784dc12-e289-36bb-b201-0b3137b8e16c","vendor":{"name":"sshnet"}}]}}],"enisaIdAdvisory":[]}