What’s Vulnerable › Vulnerabilities

CVE-2026-54336: JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-17 · updated 2026-09-09
• Weakness: CWE-22

Description

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath() in pkg/srvconn/sftp_asset.go to resolve paths outside the intended SFTP root and permit read, list, write, rename, or delete operations under the configured backend account on that asset. This issue is fixed in version 4.10.17.

Affected products

• jumpserver: from 4.8.0, < 4.10.17

References

• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr
• https://github.com/jumpserver/koko/commit/02fabebe27dacce89114fba122c667a946fd12ea
• https://github.com/jumpserver/koko/releases/tag/v4.10.17
• https://github.com/jumpserver/jumpserver/security/advisories/GHSA-x6rg-36j6-76vr

Get alerted when CVE-2026-54336 or the next vulnerability affects your stack