CVE-2026-54336: JumpServer SFTP Path Traversal Vulnerability

CVE-2026-54336 Overview

CVE-2026-54336 is a path traversal vulnerability [CWE-22] in JumpServer, an open source bastion host and operation and maintenance security audit system. The flaw resides in the KoKo Web Terminal SFTP feature, specifically in the AssetDir.GetRealPath() function within pkg/srvconn/sftp_asset.go. Authenticated users with SFTP permissions on an authorized asset can submit crafted traversal paths that resolve outside the intended SFTP root directory. Affected versions range from 4.8.0 through versions prior to 4.10.17.

Critical Impact
Authenticated attackers with SFTP access can read, list, write, rename, or delete files outside the intended SFTP root under the configured backend account on a target asset.

Affected Products

JumpServer KoKo versions 4.8.0 through 4.10.16
JumpServer deployments exposing the Web Terminal SFTP feature
Backend assets accessed through configured service accounts in JumpServer

Discovery Timeline

2026-08-17 - CVE-2026-54336 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-54336

Vulnerability Analysis

The vulnerability is a directory traversal flaw in the KoKo component of JumpServer. The AssetDir.GetRealPath() function fails to properly validate user-supplied paths before joining them with the SFTP root directory. When the SFTP session originates from the Web Terminal, the function returns the caller-supplied path directly if it begins with the root prefix string, without canonicalizing traversal sequences.

An attacker with legitimate SFTP permissions on an asset can craft paths containing ../ sequences or absolute path components. These paths bypass the intended containment boundary and reach arbitrary locations on the target asset's filesystem. The scope of access is bounded by the permissions of the configured backend account used by JumpServer to connect to that asset.

Root Cause

The root cause is insufficient path canonicalization in pkg/srvconn/sftp_asset.go. The original implementation used filepath.Join(sftpSess.rootDirPath, strings.TrimPrefix(path, "/")) and a naive strings.HasPrefix check to detect whether a Web Terminal path was already absolute. Neither operation resolves .. segments, so a crafted path such as /rootDir/../etc/passwd satisfied the prefix check and was returned verbatim.

Attack Vector

Exploitation requires authenticated access to JumpServer with SFTP permissions on at least one asset. The attacker connects through the KoKo Web Terminal SFTP interface and issues standard SFTP operations against traversal-laden paths. Successful requests allow reading, listing, writing, renaming, or deleting files anywhere the backend service account has access on the target asset.

// Security patch in pkg/srvconn/sftp_asset.go
// Source: https://github.com/jumpserver/koko/commit/02fabebe27dacce89114fba122c667a946fd12ea

func (ad *AssetDir) GetRealPath(sftpSess *SftpSession, path string) string {
-	realPath := filepath.Join(sftpSess.rootDirPath, strings.TrimPrefix(path, "/"))
-	if ad.isFromWebTerminal && path != "" && strings.HasPrefix(path, sftpSess.rootDirPath) {
-		return path
+	root := filepath.Clean(sftpSess.rootDirPath)
+	cleanPath := filepath.Clean("/" + path)
+	if ad.isFromWebTerminal && path != "" && isSubPath(root, cleanPath) {
+		return cleanPath
 	}
+	realPath := filepath.Join(root, strings.TrimPrefix(cleanPath, "/"))
 	return realPath
}

+func isSubPath(base, target string) bool {
+	base = filepath.Clean(base)
+	target = filepath.Clean(target)
+	rel, err := filepath.Rel(base, target)
+	if err != nil {
+		return false
+	}
+	return rel == "." ||
+		(rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)))
+}

The patch introduces filepath.Clean() on both the root and target paths, then uses a new isSubPath() helper that leverages filepath.Rel() to verify the requested path stays within the configured SFTP root.

Detection Methods for CVE-2026-54336

Indicators of Compromise

SFTP session logs containing traversal sequences such as ../, ..\, or URL-encoded variants in path arguments
KoKo audit records showing SFTP read, write, rename, or delete operations resolving to paths outside the asset's configured SFTP root
Access to sensitive system paths like /etc/, /root/, or application configuration directories via the Web Terminal SFTP feature

Detection Strategies

Parse JumpServer KoKo SFTP audit logs and alert when path arguments contain .. components or resolve outside declared root directories
Correlate authenticated user identity with target asset filesystem paths and flag deviations from expected working directories
Baseline normal SFTP file operations per user and asset, then alert on outliers such as access to system binaries or configuration files

Monitoring Recommendations

Forward JumpServer, KoKo, and backend asset SSH/SFTP logs to a centralized log platform for correlation and retention
Enable command auditing on backend assets under the accounts JumpServer uses, so any file activity outside expected paths is recorded server-side
Track JumpServer version inventory and alert when any deployed KoKo instance reports a version below 4.10.17

How to Mitigate CVE-2026-54336

Immediate Actions Required

Upgrade JumpServer KoKo to version 4.10.17 or later, which contains the fix committed in 02fabebe27dacce89114fba122c667a946fd12ea
Audit SFTP permission assignments and remove access from users who do not require file transfer on sensitive assets
Review historical SFTP audit logs for traversal patterns since deployment of any affected 4.8.0–4.10.16 build

Patch Information

The vendor released the fix in JumpServer KoKo v4.10.17. Technical details are documented in the GitHub Security Advisory GHSA-x6rg-36j6-76vr and the upstream commit. The patch canonicalizes paths with filepath.Clean() and enforces containment via a new isSubPath() helper.

Workarounds

Restrict SFTP permissions in JumpServer to a minimal set of trusted users until the upgrade is applied
Reduce the privileges of backend service accounts configured in JumpServer so their filesystem reach on target assets is limited
Disable the Web Terminal SFTP feature for high-value assets if operational requirements permit

bash

# Verify the running KoKo version and upgrade
docker ps --filter name=jms_koko --format '{{.Image}}'

# Pull and deploy the fixed release
docker pull jumpserver/koko:v4.10.17
docker compose -f /opt/jumpserver/compose/docker-compose.yml up -d koko

# Confirm the new version is active
docker exec jms_koko /opt/koko/koko --version