The vulnerability is a directory traversal flaw in the KoKo Web Terminal SFTP component of JumpServer. An authenticated user who has SFTP rights to an asset can supply specially crafted path names that cause the server to resolve them outside the intended SFTP root. This lets the user read, list, write, rename or delete files on the asset using the backend account’s privileges, effectively giving the user arbitrary file system access on the target host.

JumpServer versions 4.8.0 through 4.10.17 are affected. The flaw appears in the koKo library bundled with JumpServer up to release 4.10.17.

The CVSS score is 5.4, indicating a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated SFTP session to an authorized asset, which is a common setup in bastion host deployments. Once authenticated, the attacker can manipulate file paths to escape the sandbox and perform file operations with the asset’s backend account. The risk is confined to the asset that the user has SFTP access to, but it can be leveraged to exfiltrate data, tamper with logs, or disable services on that host.