Skip to main content

Evil-WinRM CVE-2026-55201

HIGH
Path Traversal (CWE-22)
2026-06-17 VulnCheck
Path Traversal Privilege Escalation Microsoft Evil Winrm
7.4
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Attacker controls a network-reachable WinRM server (AV:N, PR:N), victim must run download_dir (UI:R), and overwriting authorized_keys yields high integrity and downstream confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 17, 2026 - 20:02 vuln.today
Analysis Generated
Jun 17, 2026 - 20:02 vuln.today
CVE Published
Jun 17, 2026 - 19:08 cve.org
HIGH 7.4

DescriptionCVE.org

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem command output that are passed unsanitized to File.join(). Attackers controlling the remote server can exploit this to overwrite sensitive client-side files such as SSH authorized_keys or shell configuration files, achieving persistent access or privilege escalation on the client machine.

AnalysisAI

Path traversal in Evil-WinRM through 3.9 lets a malicious or compromised remote Windows server overwrite arbitrary files on the operator's client machine when the user invokes the download_dir() function. Because Evil-WinRM is the offensive operator's tool, this inverts the trust model - the 'target' Windows host becomes the attacker and the red teamer or admin running Evil-WinRM becomes the victim, with realistic outcomes including persistent SSH access via overwritten authorized_keys. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Stand up rogue WinRM endpoint
Delivery
Lure operator to connect
Exploit
Operator runs download_dir
Install
Server returns traversal filenames
C2
Evil-WinRM writes outside target dir
Execute
Overwrite ~/.ssh/authorized_keys
Impact
Attacker SSHes into operator host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that (1) the victim is running Evil-WinRM 3.9 or earlier, (2) the victim invokes the download_dir() function specifically - single-file download is not affected - and (3) the remote Windows endpoint the victim has authenticated to is attacker-controlled or compromised such that the attacker can influence Get-ChildItem output. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base of 7.4 (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H) accurately reflects a high-impact but conditionally triggered flaw: the attacker needs to control the WinRM server the victim connects to (AT:P) and the victim must actively run download_dir() (UI:A). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A red team operator connects Evil-WinRM to a Windows host that has been previously compromised by another actor (or is a honeypot). The operator runs 'download_dir C:\loot ./loot' to bulk-pull files; the malicious host responds to Get-ChildItem with crafted entries like '..\..\..\..\home\operator\.ssh\authorized_keys' whose contents are an attacker-controlled SSH public key, giving the attacker persistent SSH access to the operator's workstation. …
Remediation Upstream fix available as commit 6ecd570 (PR #81 at https://github.com/Hackplayers/evil-winrm/pull/81); operators should update to a build that includes this commit - the patch sanitizes each filename via File.basename and skips empty, '.' and '..' entries before joining to the local path. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all Evil-WinRM deployments through version 3.9 across red team and security operations infrastructure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2015-0016 HIGH POC
7.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2026-55201 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy