Path traversal in AsyncSSH AuthorizedKeysFile username expansion (CVE-2026-45309)

CVE-2026-45309 is a path traversal vulnerability (CWE-22) in AsyncSSH 2.22.0 in which the `AuthorizedKeysFile` `%u` token is expanded using the raw SSH username without sanitizing path separators or `..` segments. On servers configured with a per-user key pattern such as `AuthorizedKeysFile authorized_keys/%u`, an attacker who can place or reference a readable authorized-keys-format file outside the intended directory may supply a traversal username and authenticate via public-key authentication using an attacker-controlled authorized-keys file. Affected versions: - = 2.22.0 We recommend updating to: 2.23.0. CVSS 8.2 · our assessment: this_week Vendor advisory: https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753h Details: https://vuln.today/cve/CVE-2026-45309