Skip to main content

JumpServer CVE-2026-54336

| EUVDEUVD-2026-60467 MEDIUM
Path Traversal (CWE-22)
2026-08-17 GitHub_M
Path Traversal Jumpserver
5.4
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.3 MEDIUM

PR:L reflects the SFTP permission prerequisite; A:L added over vendor score because file delete and rename operations on the asset can cause availability loss beyond what A:N implies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch available
Aug 17, 2026 - 22:03 EUVD
Source Code Evidence Fetched
Aug 17, 2026 - 21:40 vuln.today
Analysis Generated
Aug 17, 2026 - 21:40 vuln.today

DescriptionCVE.org

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath() in pkg/srvconn/sftp_asset.go to resolve paths outside the intended SFTP root and permit read, list, write, rename, or delete operations under the configured backend account on that asset. This issue is fixed in version 4.10.17.

AnalysisAI

Path traversal in JumpServer's KoKo Web Terminal SFTP component (versions 4.8.0 through 4.10.16) allows authenticated users holding SFTP asset permissions to escape the intended SFTP root directory sandbox. The root cause is insufficient path normalization in AssetDir.GetRealPath() (pkg/srvconn/sftp_asset.go), where a naive strings.HasPrefix boundary check is applied before path cleaning, enabling crafted traversal sequences to bypass the root confinement. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold a valid, authenticated JumpServer account with SFTP permission explicitly granted on at least one authorized asset in the JumpServer access policy. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 5.4 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects that exploitation is network-accessible but requires a low-privilege authenticated user - specifically one with SFTP permission on an authorized JumpServer asset - which meaningfully limits the attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary fix is upgrading to JumpServer version 4.10.17, which ships the corrected KoKo component containing the properly normalized path resolution in AssetDir.GetRealPath() (fix commit https://github.com/jumpserver/koko/commit/02fabebe27dacce89114fba122c667a946fd12ea, release https://github.com/jumpserver/koko/releases/tag/v4.10.17). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Jumpserver

View all
CVE-2023-48193 CRITICAL POC
9.8 Nov 28

Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via by
CVE-2024-29202 CRITICAL POC
9.9 Mar 29

JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated critical severit
CVE-2024-29201 CRITICAL POC
9.9 Mar 29

JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated critical severit
CVE-2023-43651 CRITICAL POC
9.9 Sep 27

JumpServer is an open source bastion host. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitabl
CVE-2023-28110 CRITICAL POC
9.9 Mar 16

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref
CVE-2023-42818 CRITICAL POC
9.8 Sep 27

JumpServer is an open source bastion host. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
CVE-2023-43652 CRITICAL POC
9.1 Sep 27

JumpServer is an open source bastion host. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitabl
CVE-2023-43650 HIGH POC
7.4 Sep 27

JumpServer is an open source bastion host. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, n
CVE-2025-58044 MEDIUM POC
6.1 Dec 01

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and

CVE-2024-24763 MEDIUM POC
6.1 Feb 20

JumpServer is an open source bastion host and an operation and maintenance security audit system. Rated medium severity

CVE-2024-40629 CRITICAL
9.8 Jul 18

JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand an
CVE-2021-3169 CRITICAL
9.8 Jul 23

An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

CVE-2026-54336 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy