Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102643— AsyncSSH: SFTPServer Chroot Escape

Quick assessment

Affected
ronf asyncssh
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AsyncSSH 是一个 Python 包，它基于 Python 的 asyncio 框架，提供了 SSHv2 协议的异步客户端和服务器实现。在 2.24.1 版本之前，SFTPServer.map_path() 方法会对客户端提供的路径使用 posixpath.normpath() 进行规范化处理，并仅移除一个前导斜杠，随后将结果与配置的 chroot 目录通过 posixpath.join() 进行拼接。已认证的 SFTP 用户可以提供一个以恰好两个斜杠开头的路径，导致 POSIX 规范化过程保留双前导斜杠的形

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102643

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AsyncSSH: SFTPServer Chroot Escape
Source: CVE Program / CVE List V5
Vulnerability Description
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ronf asyncssh < 2.24.1 -

II. Public POCs for CVE-2026-102643

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102643

请登录查看更多情报信息。

Other References for CVE-2026-102643 (3)

IV. Related Vulnerabilities

Same product: asyncssh
Same vendor: ronf
Same weakness: CWE-22