AsyncSSH: SFTPServer Chroot Escape
Affects AsyncSSH SFTP servers that use the default chroot implementation. Fixed in AsyncSSH 2.24.1.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.24.1
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. SFTP server uses the default chroot implementation
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 17/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
AsyncSSH, a Python asynchronous SSH and SFTP library, is affected by a chroot escape in its SFTP server. An attacker with a low-privilege login can reach it remotely and read or write files outside the configured chroot, with the permissions of the account running the server, which may enable code execution depending on what is writable.
Read the original description
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.8/10CVSS 8.8
- No patch0/5No signal
What would change the score
- Would score about 67 if added to CISA KEV
- Would score about 62 if CISA's SSVC rates exploitation active
- Would score about 24 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
SFTP server uses the default chroot implementationUpgrade to a fixed version: 2.24.1.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- ronf asyncssh
fixed in 2.24.1
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-102643
Is CVE-2026-102643 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The default chroot used by AsyncSSH's SFTP server can be escaped, which gives access to files outside the intended directory. The impact is arbitrary file read and write as the user running the SFTP server, and this can be chained into remote code execution depending on the system setup.Source: github.com
Which versions are affected by CVE-2026-102643?
asyncssh: before 2.24.1.Source: cve.now feed data
Am I affected, and how do I check?
Only SFTP servers that use the default chroot implementation are in scope, and the affected AsyncSSH versions are those before 2.24.1. To check, look at the AsyncSSH version installed where the SFTP server runs and whether the server uses the default chroot.Source: github.com
How do I fix CVE-2026-102643?
Upgrade AsyncSSH to 2.24.1 or later, which contains the fix.Source: github.com