Wish is an SSH server with defaults and a collection of middlewares.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. May 7, 2026 · NIST NVD

   Detected

   Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ..

2. Jun 17, 2026 · NIST NVD

   Updated

   Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ..

Affected

• cpe charm/wish2.0.0

Sources

• CVE.orgVulnerability recordCVE-2026-41589

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-41589

  Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary file

  nvd.nist.gov

References

• Release Notes · github.com
• Exploit · github.com