Path Equivalence: \'//multiple/leading/slash\' in AsyncSSH - CVE-2026-102643
Published: November 9, 2026
Vulnerability identifier: #VU162796
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102643
CWE-ID: CWE-50
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker to escape the configured SFTP chroot and read or write files with the server process user's permissions.
The vulnerability exists due to improper handling of paths beginning with // in AsyncSSH's SFTPServer path mapping when chroot confinement is enabled. An authenticated remote attacker can submit these paths through SFTP operations to access files outside the restricted directory without victim interaction.
Affected software
AsyncSSH
How to mitigate CVE-2026-102643
Install security update from vendor's website.
AsyncSSH - update to 2.24.1