CVE-2026-41589
Critical
Description
Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before version 2.0.1, the SCP middleware in charm.land/wish/v2 is vulnerable to path traversal attacks. A malicious SCP client can read arbitrary files from the server, write arbitrary files to the server, and create directories outside the configured root directory by sending crafted filenames containing ../ sequences over the SCP protocol. This issue has been patched in version 2.0.1.
SeverityCritical
CVSS9.6
Exploit probability—
ProductCharm Wish
PublishedMay 7, 2026
First seenMay 7, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- charm.land/wish/v22.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| charm wish | 2.0.0 | — |
| charm.land/wish/v2Go | v < 2.0.1 | 2.0.1 |
| github.com/charmbracelet/wishGo | v ≤ 1.4.7 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.