CVE-2026-109152 - Vulnerability Details

- jbardin scp.py SCP Receive _recv_pushd path traversal

Description

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Published: 2026-10-13

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Affected is the _recv_file and _recv_pushd functions in the SCP Receive Handler of scp.py up to version 0.16.1. An attacker can craft SCP commands that cause a path traversal condition, enabling the creation or modification of files outside the intended destination directory. This remote exploitation can compromise confidentiality by reading protected files, integrity by altering critical files, and availability if essential files are overwritten. The weakness aligns with CWE‑22.

Affected Systems

The vulnerability impacts jbardin:scp.py. All releases through 0.16.1 are susceptible, while the patch incorporated in commit 42fc3aaa71411daed60544e3b40179c1038bed5d is available in release v0.16.2. Earlier versions lacking this commit remain at risk.

Risk and Exploitability

The CVSS base score is 5.3, indicating a moderate severity. EPSS is not available, so the current exploitation probability is unknown. The issue is remote and the component is commonly used for SCP transfers, making it a potential attack vector. The vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the traversal by initiating an SCP session that sends a filename including directory jumps to reach paths outside the intended base directory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

jbardin

scp.py

affected

Version	Status	Constraints
`0.16.0`	affected	—
`0.16.1`	affected	—
`0.16.2`	unaffected	—

No data.

Vendor Product Confidence Versions

Jbardin

Scp.py

95%

Version	Status	Scheme	Platform
`0.16.0`	affected	semver	—
`0.16.1`	affected	semver	—
`0.16.2`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade scp.py to version 0.16.2 or later to patch the vulnerability.
If immediate upgrade is not possible, configure the SCP service to run in a chroot or restrict the base directory so that _recv_file/_recv_pushd never writes outside the allowed path. Adjust file permissions to prevent unintended writes from untrusted clients.
Implement logging of SCP transfer attempts and audit file paths for abnormal traversal patterns, alerting on suspicious activity.

Generated by OpenCVE AI on October 13, 2026 at 11:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00464.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/jbardin/scp.py/
https://github.com/jbardin/scp.py/commit/42fc3aaa71411daed60544e3b40179c1038bed5d
https://github.com/jbardin/scp.py/issues/206
https://github.com/jbardin/scp.py/releases/tag/v0.16.2
https://nvd.nist.gov/vuln/detail/CVE-2026-109152
https://vuldb.com/cve/CVE-2026-109152
https://vuldb.com/submit/978646
https://vuldb.com/vuln/416886
https://vuldb.com/vuln/416886/cti
https://www.cve.org/CVERecord?id=CVE-2026-109152

History

Tue, 13 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-109152 https://www.cve.org/CVERecord?id=CVE-2026-109152
Metrics	threat_severity `None`	threat_severity `Moderate`

Tue, 13 Oct 2026 11:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 Oct 2026 10:00:00 +0000

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title		jbardin scp.py SCP Receive _recv_pushd path traversal
First Time appeared		Jbardin Jbardin scp.py
Weaknesses		CWE-22
CPEs		cpe:2.3:a:jbardin:scp.py::::::::
Vendors & Products		Jbardin Jbardin scp.py
References		https://github.com/jbardin/scp.py/ https://github.com/jbardin/scp.py/commit/42fc3aaa71411daed60544e3b40179c1038bed5d https://github.com/jbardin/scp.py/issues/206 https://github.com/jbardin/scp.py/releases/tag/v0.16.2 https://vuldb.com/cve/CVE-2026-109152 https://vuldb.com/submit/978646 https://vuldb.com/vuln/416886 https://vuldb.com/vuln/416886/cti
Metrics		cvssV2_0 `{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:OF/RC:C'}` cvssV3_0 `{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}` cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}`

Subscriptions

Jbardin Scp.py

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-13T09:45:13.589Z

Updated: 2026-10-13T10:56:08.083Z

Reserved: 2026-10-12T11:40:36.326Z

Link: CVE-2026-109152

Vulnrichment

Updated: 2026-10-13T10:56:03.274Z

NVD

Status : Deferred

Published: 2026-10-13T10:17:15.260

Modified: 2026-10-13T13:29:12.567

Link: CVE-2026-109152

Redhat

Severity : Moderate

Publid Date: 2026-10-13T09:45:13Z

Links: CVE-2026-109152 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-13T13:15:10Z

Weaknesses

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object