CVE-2026-41589 - Wish has SCP Path Traversal that allows arbitrary file read/write

Back Back to CVE browser

CRITICAL

Wish has SCP Path Traversal that allows arbitrary file read/write

Published May 7, 2026

9.6

CRITICAL

CVSS 3.1

EPSS 0.51%

Description

Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.

Affected products

Vendor Charmbracelet Product Wish Default
n/a
- Version
  >= 2.0.0, < 2.0.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Charmbracelet

Wish

n/a

Version	Status	Constraints
>= 2.0.0, < 2.0.1	affected	-

charm.land/wish/v2

Go

Introduced 0 Fixed 2.0.1
github.com/charmbracelet/wish

Go

Introduced 0 Fixed not fixed

Ecosystem	Package	Introduced	Fixed
Go	charm.land/wish/v2	0	2.0.1
Go	github.com/charmbracelet/wish	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

https://github.com/advisories/GHSA-xjvp-7243-rg9h
Advisory
https://github.com/charmbracelet/wish/releases/tag/v2.0.1
x_refsource_MISCRelease Notes
https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h
exploitx_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41589

Link	Providers	Tags
https://github.com/advisories/GHSA-xjvp-7243-rg9h		Advisory
https://github.com/charmbracelet/wish/releases/tag/v2.0.1		x_refsource_MISCRelease Notes
https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h		exploitx_refsource_CONFIRMMitigationVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41589