CVE catalog
CVE-2026-109152
A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to p
- Severity
- Medium · CVSS 5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.46% · Oct 25, 2026
A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficient to resolve this issue. The identifier of the patch is 42fc3aaa71411daed60544e3b40179c1038bed5d. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-scp | sid | 0.16.2-1 | fixed |
| Debian | python-scp | forky | 0.16.2-1 | fixed |
| Debian | python-scp | trixie | 0.15.0-1 | vulnerable |
| Debian | python-scp | bookworm | 0.14.4-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-scp | source | sid | 0.16.2-1 | not yet assigned | Not reported | Not reported |
| Debian | python-scp | source | forky | 0.16.2-1 | not yet assigned | Not reported | Not reported |
| Debian | python-scp | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | python-scp | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
Notes
[trixie] python-scp: Minor issue [bookworm] python-scp: Minor issue; can be fixed in next update
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-scp]Affected
Source package: [python-scp]
Details (2)
0.14.4-1· all · bookwormAffected
nvd · python-scp · debian · bookworm
0.14.4-1· all · bookwormAffected
nvd · python-scp · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-109152]
- [https://osv.dev/vulnerability/CVE-2026-109152]
- [https://security-tracker.debian.org/tracker/CVE-2026-109152]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-109152.json]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]