Every CVE Search/ Get API key

CVE-2026-109152

jbardin scp.py SCP Receive _recv_pushd path traversal

5.3 MediumFix available

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.46%Down 0.1 points since Oct 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

jbardin scp.py SCP Receive _recv_pushd path traversal

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
CVE-2026-109152
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
CVSS 3.0
5.4 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
CVSS 2.0
6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:OF/RC:C
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2026-98412 5.3

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
EUVD-2026-98412
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Updated
2026-11-02
GitHub AdvisoriesGHSA-3f22-449q-g7c5 5.3

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element...

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
GHSA-3f22-449q-g7c5
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
NVD 5.3

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
CVE-2026-109152
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Weakness
CWE-22
Updated
2026-11-02
OSV 5.3

jbardin scp.py SCP Receive _recv_pushd path traversal

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
CVE-2026-109152
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Weakness
CWE-22
Updated
2026-11-02
OSVDEBIAN-CVE-2026-109152 5.3

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
DEBIAN-CVE-2026-109152
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 4 moreShow less
OSVOESA-2026-4429 5.4

python-scp security update

The scp.py module uses a paramiko transport to send and recieve files via the scp1 protocol. This is the protocol as referenced from the openssh scp program, and has only been tested with this implementation.

Security Fix(es):

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.(CVE-2026-109152)

Record
OESA-2026-4429
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-4430 5.4

python-scp security update

The scp.py module uses a paramiko transport to send and recieve files via the scp1 protocol. This is the protocol as referenced from the openssh scp program, and has only been tested with this implementation.

Security Fix(es):

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.(CVE-2026-109152)

Record
OESA-2026-4430
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-4431 5.4

python-scp security update

The scp.py module uses a paramiko transport to send and recieve files via the scp1 protocol. This is the protocol as referenced from the openssh scp program, and has only been tested with this implementation.

Security Fix(es):

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.(CVE-2026-109152)

Record
OESA-2026-4431
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-109152 5.3

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
UBUNTU-CVE-2026-109152
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-scp
Debian:12
 All versions, plus listed versions
0.14.4-10.14.5-10.14.5-1~exp10.14.5-20.15.0-10.16.1-10.16.2-1
 None known
python-scp
Debian:13
 All versions, plus listed versions
0.15.0-10.16.1-10.16.2-1
 None known
python-scp
Debian:14
 before 0.16.2-1, plus listed versions
0.15.0-10.16.1-1
0.16.2-1
python-scp
openEuler:24.03-LTS-SP1
 before 0.14.5-2.oe2403sp1
0.14.5-2.oe2403sp1
python-scp
openEuler:24.03-LTS-SP3
 before 0.14.5-2.oe2403sp3
0.14.5-2.oe2403sp3
python-scp
openEuler:24.03-LTS-SP4
 before 0.14.5-2.oe2403sp4
0.14.5-2.oe2403sp4
python-scp
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.2-1
 None known
python-scp
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.10.2-1
 None known
python-scp
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.13.0-10.13.0-2
 None known
python-scp
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13.0-2
 None known
python-scp
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.14.5-2
 None known
python-scp
Ubuntu:26.10
 All versions, plus listed versions
0.15.0-10.16.1-1
 None known
python-scp
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.15.0-1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-109152 is a medium vulnerability (CVSS 5.3) in Jbardin Scp.py, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in python-scp 0.16.2-1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open