CVE-2026-41589

Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.

• CWE-22

• https://github.com/charmbracelet/wish/releases/tag/v2.0.1Release Notes
• https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9hExploit, Mitigation, Vendor Advisory
• https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9hExploit, Mitigation, Vendor Advisory

Published

May 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41583ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…9.1
• CVE-2026-41584ZEBRA is a Zcash node written entirely in Rust. Prior to zeb…7.5
• CVE-2026-41585ZEBRA is a Zcash node written entirely in Rust. From zebrad …6.5
• CVE-2026-41586Hyperledger Fabric is an enterprise-grade permissioned distr…9.3
• CVE-2026-41587CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …8.6
• CVE-2026-41588RELATE is a web-based courseware package. Prior to commit 2f…8.1
• CVE-2026-41591-byte OOB heap read in wc_PKCS7_DecodeEnvelopedData via zer…3.3
• CVE-2026-41591Marko is a declarative, HTML-based language for building web…6.4
• CVE-2026-4160The Fluent Forms – Customizable Contact Forms, Survey, Quiz,…5.3
• CVE-2026-41602Integer Overflow or Wraparound vulnerability in Apache Thrif…7.5
• CVE-2026-41603Rejected reason: This CVE ID is Rejected and will not be use…
• CVE-2026-41604Out-of-bounds Read vulnerability in Apache Thrift. This iss…8.2