The vulnerability is a path traversal flaw in the SCP middleware of Wish, an SSH server used by the charmbracelet project. From version 2.0.0 up to, but excluding, 2.0.1, attackers sending specially crafted SCP filenames containing "../" sequences can read, write, or create files outside the configured root directory. This flaw allows arbitrary file access and can enable the injection of malicious code, effectively providing remote code execution capabilities.

Affected systems are servers running the Wish SSH server, specifically charmbracelet Wish versions 2.0.0, 2.0.0.x, and any builds prior to 2.0.1. The issue resides in the SCP middleware and does not affect other components of Wish such as the HTTP or TTY interfaces. Adopting the patched 2.0.1 release or newer versions resolves the problem.

The CVSS score of 9.6 places this bug in the Critical range, and although the EPSS score is not available, the lack of a KEV listing does not diminish the threat because the vulnerability is trivially exploitable over the network. An attacker only needs the ability to connect to the Wish SSH service and issue SCP commands with crafted filenames; no additional privileges or credentials are required. The high severity, network-level access, and potential for code execution make immediate patching essential.