← Vulnerability feed

Vulnerability record · CVE-2026-45309 · published 17 July 2026

CVE-2026-45309: Asyncssh project asyncssh path traversal vulnerability

Asyncssh Project · Asyncssh

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.

8.2 CVSS 4.0 High EPSS 0.59% · top 51.1% CWE-22 · Path traversal
8.2CVSS 4.0 base score
0.59%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
24 Oct 2026Last modified by NVD

Description

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ronf/asyncssh/commit/2af2382cce946c959a378a62f257af253dc4ab51 Patch
https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88 Patch
https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753h ExploitVendor Advisory
https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753h ExploitVendor Advisory

Track CVE-2026-45309 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-7749Asyncssh project asyncssh improper authentication vulnerabilityThe SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests.…EPSS 1.8%6.8CVE-2023-46446Asyncssh project asyncssh insecure direct object reference vulnerabilityAn issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulati…EPSS 0.93%5.9CVE-2023-48795SSH Terrapin attack downgrades channel integrity in OpenSSH and many SSH implementationsThe SSH transport protocol with certain OpenSSH extensions mishandles the handshake and sequence numbers, letting a remote attacker omit packets from…EPSS 94%analysed5.9CVE-2023-46445Asyncssh project asyncssh insufficient verification of data authenticity vulnerabilityAn issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Ext…EPSS 0.62%6.5CVE-2025-61624Fortinet fortios path traversal vulnerabilityAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, For…KEVEPSS 1.4%9.8CVE-2021-3199Onlyoffice document server path traversal vulnerabilityDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence …KEVEPSS 30%9.8CVE-2026-104286Fortinet fortimail path traversal vulnerabilityAn improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail …KEVEPSS 4.6%9.8CVE-2026-93616Checkpoint multi-domain security management path traversal vulnerabilityA directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Managem…KEVEPSS 92%

Source: NIST National Vulnerability Database (record CVE-2026-45309), CISA KEV, FIRST EPSS (scores of 2026-11-13). This page is refreshed as NVD updates the record.