CVE-2026-48798
HighCVSS 7.1Summary
SSH.NET, an SSH library for .NET, has a vulnerability in ScpClient.Download that trusts file and directory names returned by a remote SCP server. A malicious or compromised server can use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. The issue is fixed in version 2026.0.0.
Risk Assessment
A malicious server can overwrite or create files on the client, potentially leading to system compromise or execution of malicious code.
Recommendation
Upgrade SSH.NET to version 2026.0.0 or later and avoid downloading files from untrusted servers.
Original NVD description (English source)
SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0.