Search
Find a vulnerability
Search criteria
2 vulnerabilities found for scp.py by jbardin
CVE-2026-109152 (GCVE-0-2026-109152)
Vulnerability from nvd – Published: 2026-10-13 09:45 – Updated: 2026-10-13 10:56 X_Open Source
VLAI
EPSS
VEX
Title
jbardin scp.py SCP Receive _recv_pushd path traversal
Summary
A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 10:55 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416886 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416886/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109152 | third-party-advisory |
| https://vuldb.com/submit/978646 | third-party-advisory |
| https://github.com/jbardin/scp.py/issues/206 | issue-tracking |
| https://github.com/jbardin/scp.py/commit/42fc3aaa… | patch |
| https://github.com/jbardin/scp.py/releases/tag/v0.16.2 | patch |
| https://github.com/jbardin/scp.py/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T10:55:52.426641Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T10:56:08.083Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:jbardin:scp.py:*:*:*:*:*:*:*:*"
],
"modules": [
"SCP Receive Handler"
],
"product": "scp.py",
"vendor": "jbardin",
"versions": [
{
"status": "affected",
"version": "0.16.0"
},
{
"status": "affected",
"version": "0.16.1"
},
{
"status": "unaffected",
"version": "0.16.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohammedix88 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T09:45:13.589Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416886 | jbardin scp.py SCP Receive _recv_pushd path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416886"
},
{
"name": "VDB-416886 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416886/cti"
},
{
"name": "CVE-2026-109152 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109152"
},
{
"name": "Submit #978646 | jbardin scp.py 0.16.1 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/978646"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/jbardin/scp.py/issues/206"
},
{
"tags": [
"patch"
],
"url": "https://github.com/jbardin/scp.py/commit/42fc3aaa71411daed60544e3b40179c1038bed5d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/jbardin/scp.py/releases/tag/v0.16.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/jbardin/scp.py/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T13:46:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "jbardin scp.py SCP Receive _recv_pushd path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109152",
"datePublished": "2026-10-13T09:45:13.589Z",
"dateReserved": "2026-10-12T11:40:36.326Z",
"dateUpdated": "2026-10-13T10:56:08.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109152 (GCVE-0-2026-109152)
Vulnerability from cvelistv5 – Published: 2026-10-13 09:45 – Updated: 2026-10-13 10:56 X_Open Source
VLAI
EPSS
VEX
Title
jbardin scp.py SCP Receive _recv_pushd path traversal
Summary
A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 10:55 UTC
CWE
- CWE-22 - Path Traversal
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416886 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416886/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109152 | third-party-advisory |
| https://vuldb.com/submit/978646 | third-party-advisory |
| https://github.com/jbardin/scp.py/issues/206 | issue-tracking |
| https://github.com/jbardin/scp.py/commit/42fc3aaa… | patch |
| https://github.com/jbardin/scp.py/releases/tag/v0.16.2 | patch |
| https://github.com/jbardin/scp.py/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T10:55:52.426641Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T10:56:08.083Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:jbardin:scp.py:*:*:*:*:*:*:*:*"
],
"modules": [
"SCP Receive Handler"
],
"product": "scp.py",
"vendor": "jbardin",
"versions": [
{
"status": "affected",
"version": "0.16.0"
},
{
"status": "affected",
"version": "0.16.1"
},
{
"status": "unaffected",
"version": "0.16.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohammedix88 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T09:45:13.589Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416886 | jbardin scp.py SCP Receive _recv_pushd path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416886"
},
{
"name": "VDB-416886 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416886/cti"
},
{
"name": "CVE-2026-109152 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109152"
},
{
"name": "Submit #978646 | jbardin scp.py 0.16.1 Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/978646"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/jbardin/scp.py/issues/206"
},
{
"tags": [
"patch"
],
"url": "https://github.com/jbardin/scp.py/commit/42fc3aaa71411daed60544e3b40179c1038bed5d"
},
{
"tags": [
"patch"
],
"url": "https://github.com/jbardin/scp.py/releases/tag/v0.16.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/jbardin/scp.py/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T13:46:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "jbardin scp.py SCP Receive _recv_pushd path traversal",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109152",
"datePublished": "2026-10-13T09:45:13.589Z",
"dateReserved": "2026-10-12T11:40:36.326Z",
"dateUpdated": "2026-10-13T10:56:08.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}