Vulnerability · Published Jun 17, 2026 · Assigned by VulnCheck

CVE-2026-55201Evil-WinRM - Path Traversal in download_dir() Function

Medium 6.8

In plain English

A medium-severity path traversal in evil-winrm from Hackplayers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.3%top 76.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem command output that are passed unsanitized to File.join(). Attackers controlling the remote server can exploit this to overwrite sensitive client-side files such as SSH authorized_keys or shell configuration files, achieving persistent access or privilege escalation on the client machine.

Affected products (as reported)

Vendor	Product	Versions
Hackplayers	evil-winrm	0 – through 3.9

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/evil-winrm-path-traversal-in-download-dir-function third-party-advisory