CVE-2026-54336

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath() in pkg/srvconn/sftp_asset.go to resolve paths outside the intended SFTP root and permit read, list, write, rename, or delete operations under the configured backend account on that asset. This issue is fixed in version 4.10.17.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr
https://github.com/jumpserver/koko/commit/02fabebe27dacce89114fba122c667a946fd12ea
https://github.com/jumpserver/koko/releases/tag/v4.10.17
https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-17 21:16

Updated : 2026-09-09 21:11

NVD link : CVE-2026-54336

Mitre link : CVE-2026-54336

CVE.ORG link : CVE-2026-54336

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-54336", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54336", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T13:04:01.699543Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jumpserver", "product": "jumpserver", "versions": [{"status": "affected", "version": ">= 4.8.0, < 4.10.17"}]}]}], "published": "2026-08-17T21:16:45.930", "references": [{"url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr", "source": "security-advisories@github.com"}, {"url": "https://github.com/jumpserver/koko/commit/02fabebe27dacce89114fba122c667a946fd12ea", "source": "security-advisories@github.com"}, {"url": "https://github.com/jumpserver/koko/releases/tag/v4.10.17", "source": "security-advisories@github.com"}, {"url": "https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath() in pkg/srvconn/sftp_asset.go to resolve paths outside the intended SFTP root and permit read, list, write, rename, or delete operations under the configured backend account on that asset. This issue is fixed in version 4.10.17."}], "lastModified": "2026-09-09T21:11:46.833", "sourceIdentifier": "security-advisories@github.com"}