CVE-2016-5725

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

24.14%

Published

Jan 19, 2017

Modified

May 12, 2026

Public PoC / Exploit (2)

All weaponized →

Exploit-DBJCraft/JSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.

Weaknesses (CWE)

CWE-22

Affected Products (2)

jcraft · jschvulnerable

microsoft · windows

References (20)

http://packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.html

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/Sep/53

Mailing ListThird Party Advisory

http://www.jcraft.com/jsch/ChangeLog

Release Notes

http://www.securityfocus.com/bid/93100

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:3115

https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/04/msg00017.html

https://www.exploit-db.com/exploits/40411/

Third Party AdvisoryVDB Entry

https://www.oracle.com/security-alerts/cpuApr2021.html

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpuoct2020.html

http://packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.html

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/Sep/53

Mailing ListThird Party Advisory

http://www.jcraft.com/jsch/ChangeLog

Release Notes

http://www.securityfocus.com/bid/93100

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:3115

https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/04/msg00017.html

https://www.exploit-db.com/exploits/40411/

Third Party AdvisoryVDB Entry

https://www.oracle.com/security-alerts/cpuApr2021.html

KEV Catalog EPSS Scores Vendors All CVEs