CVE-2026-45309
HIGHAsyncSSH < 2.23.0 - AuthorizedKeysFile Username Path Traversal
Title source: manualDescription
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753h
X_Refsource_Misc x_refsource_misc
https://github.com/ronf/asyncssh/commit/2af2382cce946c959a378a62f257af253dc4ab51
X_Refsource_Misc x_refsource_misc
https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88
Scores
CVSS v3
7.5
EPSS
0.0044
EPSS Percentile
36.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (2)
asyncssh_project/asyncssh
< 2.23.0
ronf/asyncssh
< 2.23.0
Published
Jul 17, 2026
Tracked Since
Jul 18, 2026