SSH.NET CVE-2026-48798

Exploitation requires the victim application to call ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) - the recursive directory download overload specifically - against a server the attacker controls or has compromised, or against a connection subject to man-in-the-middle interception. Single-file downloads and SFTP/SSH operations within the same library are not affected. If SSH host key verification is properly enforced (known_hosts or pinned fingerprint), the MITM vector is eliminated, leaving only the malicious-or-compromised-server scenario. The attack does not require any authentication against the client host; the CVSS PR:N reflects that the attacker's server role requires no client-side privileges. Exploitation is limited to the filesystem permissions of the process running the SSH.NET client.

The NVD-assigned CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) reflects a network-reachable, unauthenticated attack requiring only that the victim initiate a recursive SCP download. The I:H metric is well-supported: arbitrary file write to locations like ~/.ssh/authorized_keys constitutes a complete integrity compromise of the client host. The UI:R requirement is a genuine friction point in interactive use, but in automated CI/CD pipelines or deployment scripts that pull artifacts via SCP, user interaction is effectively absent. No EPSS score was provided in the input data, and the vulnerability is not listed in CISA KEV, suggesting exploitation has not been observed at scale. The MITM vector requires network positioning (which would normally warrant AC:H), but the 'malicious server' case - where the victim has been directed to a server under attacker control - requires no such positioning and justifies AC:L for the overall risk envelope. Even a mid-sized development team whose CI pipelines download artifacts over SCP from a third-party host should treat this as urgent given the potential for supply-chain-style file overwrites. The absence of a confidentiality impact (C:N) is accurate since the attack is write-only.

An attacker operates or compromises an SCP server that a target application connects to for artifact retrieval. When the SSH.NET client calls ScpClient.Download() for a remote directory, the attacker's server responds with SCP 'D' (directory) and 'C' (file) records containing names such as '../../../home/appuser/.ssh/authorized_keys'. The unpatched client writes the attacker-supplied content to that resolved path, adding the attacker's public key and enabling subsequent SSH login as the application user.