AsyncSSH's SFTP client trusted filenames returned by a remote SFTP server during recursive copy operations. Because these filenames were not sanitized, a malicious server could supply absolute paths or paths containing traversal components, causing the client to construct local file paths that escape the intended target directory. The resulting file writes occur to arbitrary locations on the client machine that are writable by the user running the process. This path‑traversal flaw is recognized as CWE‑22 and could expose the client to arbitrary file write and execution vulnerabilities.

The vulnerability affects the AsyncSSH Python library produced by ronf. Versions prior to 2.24.1 of asyncssh are impacted. Upgrade to version 2.24.1 or later to remove the flaw.

The CVSS score of 6.5 indicates a medium severity. Exploitation would require an attacker to control or compromise an SFTP server that the client connects to; no local privilege or execution is needed on the client side. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited over the network by sending crafted directory listings, making this a remotely exploitable vector for adversaries who can host or influence the SFTP server.