CVE-2026-53980 | BDVDB-2026-400930 Detail

Description#

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in git.Middleware(). Attackers can use a single-depth path ../evil, or on Windows a payload ..\..\evil that defeats the slash-count guard entirely, to read or write arbitrary repositories outside the intended root via git-upload-pack, git-upload-archive, or git-receive-pack.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-11-06Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.