CVE-2016-5725
MEDIUM5.9EPSS 26.7%Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch
Published: 5/13/2022Modified: 4/28/2026
Description
Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
Affected packages (4)
- Debian/jschfrom 0, < 0.1.54-1
- Debian/jschfrom 0, < 0.1.51-1+deb8u1
- Debian/jschfrom 0, < 0.1.42-2+deb7u1
- Maven/com.jcraft:jschfrom 0, < 0.1.54
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
References (12)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-5725
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-5725
- WEBhttp://packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.html
- WEBhttps://access.redhat.com/errata/RHSA-2017:3115
- WEBhttp://seclists.org/fulldisclosure/2016/Sep/53
- WEBhttps://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725
- WEBhttps://lists.debian.org/debian-lts-announce/2020/04/msg00017.html
- WEBhttps://www.exploit-db.com/exploits/40411
- WEBhttps://www.oracle.com/security-alerts/cpuApr2021.html
- WEBhttps://www.oracle.com/security-alerts/cpujan2021.html
- WEBhttps://www.oracle.com/security-alerts/cpuoct2020.html
- WEBhttp://www.jcraft.com/jsch/ChangeLog