ronf AsyncSSH 2.23.0/2.23.1/2.24.0 Path Normalization SFTPServer.map_path access control

Summaryinfo

A vulnerability classified as critical was found in ronf AsyncSSH. Affected by this issue is the function SFTPServer.map_path of the component Path Normalization. Such manipulation leads to access control. This vulnerability is uniquely identified as CVE-2026-102643. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in ronf AsyncSSH. It has been rated as critical. Affected by this issue is the function SFTPServer.map_path of the component Path Normalization. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-102643 since 09/29/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 2.24.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ronf

Name

• AsyncSSH

Version

• 2.23.0
• 2.23.1
• 2.24.0

Website

• Product: https://github.com/ronf/asyncssh/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion