Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-85756— SSH.NET: ScpClient allows server-side RCE via default SCP path handling

Quick assessment

Affected
sshnet SSH.NET
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SSH.NET 是一个用于 .NET 的 Secure Shell（SSH）库。在 2026.0.0 版本之前， 会将调用者提供的远程路径直接拼接到用于在服务器上执行 命令的指令中，而默认的 转换方式无法安全地对所有远程命令解释器（shell）进行引号处理。 如果应用程序将攻击者可控的路径传递给基于 shell 的服务器，且当前激活的 未能正确中和该 shell 解释器中的特殊元字符（metacharacters），则可能导致以经过身份验证的 SSH 用户权限执行任意命令。 利用此漏洞需要满足以下条件： 1. 服务

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85756

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SSH.NET: ScpClient allows server-side RCE via default SCP path handling
Source: CVE Program / CVE List V5
Vulnerability Description
SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into the command used to run scp on the server, and the default RemotePathTransformation.DoubleQuote transformation cannot safely quote every remote command interpreter. When an application passes an attacker-controlled path to a shell-based server, shell metacharacters not neutralized by the active IRemotePathTransformation can execute commands as the authenticated SSH user. Exploitation requires a shell-based server and a path crafted for that shell's parsing rules; non-shell servers and paths fully neutralized by the selected transformation are not affected. RemotePathTransformation.ShellQuote is available for POSIX shells, while SftpClient avoids a remote shell entirely. This issue is fixed in version 2026.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sshnet SSH.NET < 2026.0.0 -

II. Public POCs for CVE-2026-85756

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85756

请登录查看更多情报信息。

Vendor Pages for CVE-2026-85756 (1)

Other References for CVE-2026-85756 (1)

IV. Related Vulnerabilities

Same product: SSH.NET
Same vendor: sshnet
Same weakness: CWE-78

V. Comments for CVE-2026-85756

No comments yet

Leave a comment