CVE-2016-5725 in JD Edwards EnterpriseOne Tools
Summary
by MITRE
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/14/2026
The CVE-2016-5725 vulnerability represents a critical directory traversal flaw in the JCraft JSch library version 0.1.53 and earlier, specifically affecting Windows environments where the ChannelSftp.OVERWRITE mode is utilized. This vulnerability exposes applications that rely on JSch for SFTP operations to potential unauthorized file system access and modification. The flaw manifests when remote SFTP servers respond to recursive GET commands with ..\ sequences, allowing malicious actors to traverse directory structures and write files to locations outside the intended target directories.
The technical implementation of this vulnerability stems from insufficient input validation within the JSch library's SFTP client implementation. When processing directory listings from remote servers, the library fails to properly sanitize path components that contain ..\ sequences, which are legitimate path traversal indicators on Windows systems. The vulnerability becomes exploitable specifically when the ChannelSftp.OVERWRITE mode is active, as this mode permits file overwrites without proper path verification mechanisms. The flaw is particularly dangerous because it operates at the SFTP protocol level where the client processes responses from potentially malicious servers, effectively allowing remote code execution through file system manipulation.
From an operational perspective, this vulnerability poses significant risks to any system that utilizes JSch for SFTP communications, particularly in enterprise environments where automated file transfers and remote server management are common. Attackers can leverage this flaw to write arbitrary files to system directories, potentially leading to privilege escalation, data corruption, or system compromise. The vulnerability affects not only the immediate file system but also broader security controls since it enables attackers to place malicious files in critical locations such as system directories, configuration files, or executable locations. This makes the vulnerability particularly attractive to threat actors seeking persistent access or system-wide compromise.
The impact of CVE-2016-5725 aligns with CWE-22 Directory Traversal vulnerabilities, which are categorized under the broader weakness of improper input validation. This vulnerability also maps to ATT&CK technique T1059 Command and Scripting Interpreter where attackers can execute malicious commands through file system manipulation. Organizations using JSch libraries should prioritize immediate patching to version 0.1.54 or later, as this update includes proper path validation and sanitization for ..\ sequences in SFTP responses. Additional mitigations include implementing network segmentation to limit SFTP server access, monitoring SFTP traffic for suspicious path patterns, and configuring applications to avoid using ChannelSftp.OVERWRITE mode when possible. Security teams should also conduct comprehensive vulnerability assessments to identify systems that may be running affected versions of JSch and establish proper input validation controls for all SFTP operations to prevent similar traversal attacks in other components of the infrastructure.