CVE-2026-102643

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.

• CWE-22
• CWE-50

• https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf
• https://github.com/ronf/asyncssh/releases/tag/v2.24.1
• https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9
• https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9

Published

Nov 9, 2026

Last Modified

Nov 14, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102635ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain u…5.3
• CVE-2026-102636A maliciously crafted HTML payload in a design name, when di…7.1
• CVE-2026-102637A maliciously crafted HTML payload in the documentName param…7.1
• CVE-2026-102638A maliciously crafted HTML payload in the description of an …7.1
• CVE-2026-102639MobilityDB version 1.3.0 and earlier contains an out-of-boun…6.5
• CVE-2026-10264A vulnerability was determined in lharries whatsapp-mcp 0.0.…3.5
• CVE-2026-102649Burrito is a Terraform Automation Collaboration Software (TA…9.9
• CVE-2026-10265A vulnerability was identified in itsourcecode Content Manag…6.3
• CVE-2026-102650Nuxt Content is the file-based CMS for Nuxt applications, po…7.5
• CVE-2026-102657esm.sh is a no-build content delivery network (CDN) for web …7.5
• CVE-2026-102663OpenList is a file list program that supports multiple stora…4.3
• CVE-2026-102664ProxySQL is a proxy for MySQL and its forks, as well as Post…7.1