Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by VulDB

CVE-2026-109152jbardin scp.py SCP Receive _recv_pushd path traversal

Medium 5.4

In plain English

A medium-severity path traversal in scp.py from jbardin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.5%top 59.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-scpno fix listedDEBIAN-CVE-2026-109152
Debian:13python-scpno fix listedDEBIAN-CVE-2026-109152
Debian:14python-scp0.16.2-1DEBIAN-CVE-2026-109152
Ubuntu:22.04:LTSpython-scpno fix listedUBUNTU-CVE-2026-109152
Ubuntu:24.04:LTSpython-scpno fix listedUBUNTU-CVE-2026-109152
Ubuntu:26.04:LTSpython-scpno fix listedUBUNTU-CVE-2026-109152
Ubuntu:26.10python-scpno fix listedUBUNTU-CVE-2026-109152

Affected products (as reported)

VendorProductVersions
jbardin scp.py 0.16.00.16.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C

References