{"affected":[{"product":"asyncssh","source":"CNA: GitHub_M","vendor":"ronf","versions":[{"status":"affected","version":"< 2.24.1"}]}],"cveId":"CVE-2026-102643","cwes":["CWE-22","CWE-50"],"description":"AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794261095575,"publishedAt":1794261095575,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ronf/asyncssh/releases/tag/v2.24.1"}],"remediation":[],"revision":"458900267350ea32c82f0183054531a53e7e9b86e9e8649e6233d29341723fac","sources":[{"modifiedAt":1794261095575,"name":"CNA: GitHub_M","retrievedAt":1794262102000,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102643"}],"ssvc":null,"status":"published","title":"AsyncSSH: SFTPServer Chroot Escape","updatedAt":1794262102000}