Vulnerabilidades do Charm Wish
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Charm Wish: 1 registro(s), com versões afetadas e correções.cpe:2.3:a:charm:wish
CVE-2026-41589
Crítica · 9.6
CWE-22 07/05/2026
Wish has SCP Path Traversal that allows arbitrary file read/write
Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.