CVE-2026-54336

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54336
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54336.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54336
Aliases
  • GHSA-x6rg-36j6-76vr
Published
2026-08-17T21:01:48.667Z
Modified
2026-08-20T03:30:19.235363581Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset
Details

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath() in pkg/srvconn/sftp_asset.go to resolve paths outside the intended SFTP root and permit read, list, write, rename, or delete operations under the configured backend account on that asset. This issue is fixed in version 4.10.17.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54336.json"
}
References

Affected packages

Git / github.com/jumpserver/jumpserver

Affected ranges

Type
GIT
Repo
https://github.com/jumpserver/jumpserver
Events
Introduced
6d66ba528874b7758c8745b6bbe0ebed641fe1d4
Fixed
c92f58554e2bd6651a91590a4ab2517cf77d6bf1
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.8.0"
        },
        {
            "fixed": "4.10.17"
        }
    ],
    "source": "AFFECTED_FIELD"
}
Type
GIT
Repo
https://github.com/jumpserver/koko
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
02fabebe27dacce89114fba122c667a946fd12ea
Fixed
e8234800ffaa46fec7e1e0350ec1a0f6345057da
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

1.*
1.5.1
1.5.3
1.5.5
1.5.6
1.5.8
1.5.9
2.*
2.0.0
2.0.1
v2.*
v2.1.0
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.11.0
v2.11.1
v2.12.0
v2.13.0
v2.13.1
v2.13.2
v2.14.0
v2.15.0
v2.15.1
v2.15.2
v2.15.3
v2.15.4
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.20.0
v2.20.1
v2.21.0
v2.22.0
v2.22.1
v2.22.3
v2.22.4
v2.23.0
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0
v2.9.1
v2.9.2
v3.*
v3.4.0
v4.*
v4.0.1
v4.1.0
v4.10.0
v4.10.10
v4.10.11
v4.10.13
v4.10.14
v4.10.15
v4.10.16
v4.10.2
v4.10.4
v4.10.5
v4.10.6
v4.10.8
v4.3.0
v4.3.1
v4.4.1
v4.5.0
v4.6.0
v4.7.0
v4.8.0
v4.8.1
v4.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54336.json"