CVE-2026-55201— Evil-WinRM - Path Traversal in download_dir() Function

Evil-WinRM - Path Traversal in download_dir() Function

Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the download_dir() function that allows a rogue or compromised remote Windows server to write files outside the intended download directory by returning filenames with traversal sequences from Get-ChildItem command output that are passed unsanitized to File.join(). Attackers controlling the remote server can exploit this to overwrite sensitive client-side files such as SSH authorized_keys or shell configuration files, achieving persistent access or privilege escalation on the client machine.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

对路径名的限制不恰当(路径遍历)

Hackplayers Evil-WinRM 路径遍历漏洞

Evil-WinRM是西班牙Hackplayers公司开源的一款用于渗透测试的远程管理工具。 Hackplayers Evil-WinRM 3.9及之前版本存在路径遍历漏洞，该漏洞源于download_dir()函数存在路径遍历问题，远程恶意Windows服务器返回带有遍历序列的文件名未经验证传递给File.join()，可能导致写文件到预期下载目录之外，攻击者可通过控制远程服务器覆盖敏感客户端文件，实现持久访问或权限提升。

N/A

N/A