{"id":"CVE-2016-5725","aliases":["DEBIAN-CVE-2016-5725","DLA-2184-1","DLA-611-1","EUVD-2022-4872","GHSA-q446-82vq-w674","MGASA-2016-0311","SUSE-SU-2017:0715-1"],"status":"published","title":"Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch","description":"Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\\ (dot dot backslash) in a response to a recursive GET command.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.24143,"percentile":0.97863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2016-09-05T00:00:00Z","modified":"2026-09-22T07:01:44Z","exploits":[{"source":"exploitdb","id":"EDB-40411","title":"JCraft/JSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal","type":"dos","platform":"windows","date":"2016-09-22","verified":true,"url":"https://www.exploit-db.com/exploits/40411"}],"fixes":[{"ecosystem":"Maven","package":"com.jcraft:jsch","fixed_in":["0.1.54"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jsch","fixed_in":["0.1.54-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jsch","fixed_in":["0.1.54-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jsch","fixed_in":["0.1.54-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"jsch","fixed_in":["0.1.51-1+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"jsch","fixed_in":["0.1.42-2+deb7u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"jsch","fixed_in":["0.1.51-4.1.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 3.0","package":"jsch","fixed_in":["0.1.54-3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.jcraft:jsch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.53"},{"fixed":"0.1.54"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jsch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.54-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jsch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.54-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jsch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.54-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"jsch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.51-1+deb8u1"}]}],"versions":["0.1.51-1"]},{"source":"osv","ecosystem":"Debian:7","package":"jsch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.42-2+deb7u1"}]}],"versions":["0.1.42-2"]},{"source":"osv","ecosystem":"Maven","package":"com.jcraft:jsch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.54"}]}],"versions":["0.1.23","0.1.24","0.1.25","0.1.27","0.1.29","0.1.31","0.1.38","0.1.41","0.1.42","0.1.43","0.1.43-1","0.1.44","0.1.44-1","0.1.45","0.1.46","0.1.47","0.1.48","0.1.49","0.1.50","0.1.51","0.1.52","0.1.53"]},{"source":"osv","ecosystem":"Mageia:5","package":"jsch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.51-4.1.mga5"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 3.0","package":"jsch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.54-3.1"}]}]}],"products":[{"vendor":"jcraft","product":"jsch"}],"references":[{"url":"http://seclists.org/fulldisclosure/2016/Sep/53","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/93100","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3115","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/40411/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/04/msg00017.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.jcraft.com/jsch/ChangeLog","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5725","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q446-82vq-w674"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-5725","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/40411","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0311.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19296","tags":["report"]},{"url":"http://lwn.net/Alerts/699659/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170715-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/997542","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5725","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-5725","description":"Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\\ (dot dot backslash) in a response to a recursive GET command.","status":"published","published":"2017-01-19T22:00:00Z","modified":"2024-08-06T01:07:59.976Z","updated_at":"2026-11-02T14:33:30.359814Z"}],"euvd":[{"id":"EUVD-2022-4872","description":"Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\\ (dot dot backslash) in a response to a recursive GET command.","status":"published","published":"2017-01-19T22:00:00Z","modified":"2024-08-06T01:07:59Z","updated_at":"2026-11-03T02:22:42.006781Z"}],"ghsa":[{"id":"GHSA-q446-82vq-w674","title":"Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch","description":"Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\\ (dot dot backslash) in a response to a recursive GET command.","status":"published","published":"2022-05-13T01:09:33Z","modified":"2023-01-27T05:02:13Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:17.04874Z"}],"nvd":[{"id":"CVE-2016-5725","description":"Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\\ (dot dot backslash) in a response to a recursive GET command.","status":"published","published":"2017-01-19T22:59:00.15Z","modified":"2026-06-17T00:49:56.163Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"CVE-2016-5725","description":"Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\\ (dot dot backslash) in a response to a recursive GET command.","status":"published","published":"2017-01-19T22:59:00.15Z","modified":"2026-04-16T06:20:40.15735492Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-5725","description":"Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\\ (dot dot backslash) in a response to a recursive GET command.","status":"published","published":"2017-01-19T22:59:00.15Z","modified":"2026-09-22T07:01:44.315365509Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"GHSA-q446-82vq-w674","title":"Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch","description":"Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\\ (dot dot backslash) in a response to a recursive GET command.","status":"published","published":"2022-05-13T01:09:33Z","modified":"2026-09-10T03:49:36.585091816Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"DLA-2184-1","title":"jsch - security update","status":"published","published":"2020-04-25T00:00:00Z","modified":"2026-03-09T01:19:35.464043Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-611-1","title":"jsch - security update","status":"published","published":"2016-09-05T00:00:00Z","modified":"2026-03-09T02:09:27.053283Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0311","title":"Updated jsch packages fix security vulnerability","description":"It was discovered that there was a path traversal vulnerability in jsch\n(CVE-2016-5725).\n","status":"published","published":"2016-09-21T20:38:22Z","modified":"2026-04-16T06:23:51.627479819Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2017:0715-1","title":"Security update for jsch","description":"\nThis update for jsch to version 0.1.54 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-5725: recursive sftp get client-side windows path traversal (bsc#997542).\n\nBugfixes:\n- sftp-put may send the garbage data in some rare case.\n- fixed a deadlock bug in KnownHosts#getHostKey().\n- SftpProgressMonitor#init() was not invoked in sftp-put by using the output-stream.\n- KnownHosts#setKnownHosts() should accept the non-existing file.\n- excluding the user interaction time from the timeout value.\n- addressing SFTP slow file transfer speed with Titan FTP.\n- updating copyright messages; 2015 -\u003e 2016\n","status":"published","published":"2017-03-17T07:36:39Z","modified":"2026-02-04T04:18:36.67598Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}