Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-41589: Wish SSH server lets files be accessed outside root

CVE-2026-41589 · published 5 months ago

Summary

Versions 2.0.0 up to but not including 2.0.1 of the Wish SSH server allow a specially crafted file name to move outside the intended directory. An attacker could read, write, or create files anywhere on the system. Update to version 2.0.1 as soon as possible to stop this behavior.

What to do

Update wish charm.land/wish/v2 to version 2.0.1.
Update charm.land wish to version 2.0.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Go	wish	charm.land/wish/v2	< 2.0.1 Fix: upgrade to 2.0.1
Go	charmbracelet	github.com/charmbracelet/wish	<= 1.4.7
go	charm.land	wish	< 2.0.1 Fix: upgrade to 2.0.1
go	github.com	charmbracelet	<= 1.4.7
–	charm	wish	2.0.0 `cpe:2.3:a:charm:wish:2.0.0:::::::*`

Original advisory text

Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.

References

https://github.com/charmbracelet/wish/releases/tag/v2.0.1 Release Notes
https://nvd.nist.gov/vuln/detail/CVE-2026-41589 Vendor Advisory
https://github.com/charmbracelet/wish Product
https://github.com/advisories/GHSA-xjvp-7243-rg9h
https://github.com/charmbracelet/wish/security/advisories/GHSA-xjvp-7243-rg9h Exploit Mitigation Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.6 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-22Path Traversal

Timeline

Published7 May 2026

Updated22 Oct 2026

First seen7 May 2026

Sources

CVE-2026-41589 · NVD

GHSA-xjvp-7243-rg9h · OSV

GO-2026-5762 · OSV

Track software like this

Free during beta