{"id":"CVE-2026-48798","title":"SSH.NET is a Secure Shell (SSH) library for .NET","summary":"SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the r…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","cwe":["CWE-22","CWE-73"],"vendor":"SSH","product":"SSH.NET","affected":["SSH.NET <= 2025.1.0"],"patched":["SSH.NET 2026.0.0"],"published":"2026-08-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:05:53.723","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48798","references":[{"url":"https://github.com/sshnet/SSH.NET/commit/600be0de543765995a189b5d7cd4efac5007f3ce","label":"security-advisories@github.com"},{"url":"https://github.com/sshnet/SSH.NET/releases/tag/2026.0.0","label":"security-advisories@github.com"},{"url":"https://github.com/sshnet/SSH.NET/security/advisories/GHSA-q939-rpr3-3284","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-q939-rpr3-3284"}],"tags":["nvd","ghsa","nuget"],"epss":0.0038,"epssPercentile":0.31808,"aliases":["GHSA-q939-rpr3-3284"],"ecosystem":"nuget","ingestedAt":"2026-08-12T15:53:05.887Z","slug":"CVE-2026-48798","body":"## Overview\n\nSSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-48798)\n\nAffected packages:\n\n- `SSH.NET <= 2025.1.0`\n\nPatched in:\n\n- `SSH.NET 2026.0.0`\n\nSource: https://github.com/advisories/GHSA-q939-rpr3-3284","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}