Hackplayers evil-winrm up to 3.9 Configuration download_dir path traversal

Summaryinfo

A vulnerability, which was classified as critical, was found in Hackplayers evil-winrm up to 3.9. Affected by this vulnerability is the function download_dir of the component Configuration Handler. The manipulation results in path traversal. This vulnerability was named CVE-2026-55201. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Hackplayers evil-winrm up to 3.9. Affected is the function download_dir of the component Configuration Handler. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem command output that are passed unsanitized to File.join(). Attackers controlling the remote server can exploit this to overwrite sensitive client-side files such as SSH authorized_keys or shell configuration files, achieving persistent access or privilege escalation on the client machine.

The weakness was presented by Tristan Madani. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-55201 since 06/16/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading eliminates this vulnerability. Applying the patch 6ecd570a298562dc72ad73978307eb34182f5850 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-37785). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Hackplayers

Name

• evil-winrm

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9

Website

• Product: https://github.com/Hackplayers/evil-winrm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion