External Control of File Name or Path Affecting ssh.net package, versions [,2026.0.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about External Control of File Name or Path vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-DOTNET-SSHNET-18748188
- published13 Aug 2026
- disclosed12 Aug 2026
- creditNadav0077, igorpyan
Introduced: 12 Aug 2026
NewCVE-2026-48798 (opens in a new tab)How to fix?
Upgrade SSH.NET to version 2026.0.0 or higher.
Overview
SSH.NET is a Secure Shell (SSH) library for .NET, optimized for parallelism and with broad framework support.
Affected versions of this package are vulnerable to External Control of File Name or Path via server-controlled SCP filenames through the recursive download path in ScpClient.Download(string, DirectoryInfo) in ScpClient.cs. An attacker can write or overwrite files outside the intended destination directory by serving a malicious SCP directory download with file or directory names containing ../, absolute paths, drive qualifiers, or platform-specific path separators. This can corrupt user files and, if sensitive paths are targeted, enable persistence, privilege escalation, or remote code execution on the client host.