CVE-2026-55201: Evil-WinRM - Path Traversal in download_dir() Function

Synopsis

A path traversal vulnerability exists in Evil-WinRM (versions through 3.9) inside the download_dir() function. A rogue or compromised remote Windows server can return filenames containing directory traversal sequences (such as ../../) from Get-ChildItem output; because these filenames are passed unsanitized to File.join(), files land outside the intended download directory on the client machine. Successful exploitation lets an attacker overwrite sensitive client-side files like SSH authorized_keys or shell configuration files, enabling persistent access or privilege escalation on the operator's machine. A patched-image rebuild at commit 6ecd570a298562dc72ad73978307eb34182f5850 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must control a remote Windows server reachable over the network that the Evil-WinRM client connects to; exploitation is initiated through that server-client connection.

• AuthenticationNot required

  No authentication on the attacker's side is required; the attacker operates by controlling the server the victim operator chooses to connect to, not by authenticating to a protected service.

• Victim interactionRequired

  The Evil-WinRM operator (victim) must initiate a download_dir() operation against the rogue or compromised server, making this a social-engineering or supply-chain scenario where the operator is directed to connect.

• Attack complexityDetail

  Attack complexity is low in that the exploit itself is reliable and condition-free once the attacker controls the server, though the additional attack requirement (AT:P) notes a prerequisite that the victim must be induced to connect to the malicious endpoint.

Blast Radius

• An attacker overwrites client-side files such as ~/.ssh/authorized_keys, inserting their own public key and gaining persistent SSH access to the operator's machine without a password.
• Shell configuration files (e.g. .bashrc, .zshrc, .profile) can be replaced or appended to, executing attacker-controlled commands every time the operator opens a shell session.
• Any file writable by the user running Evil-WinRM is a candidate for overwrite, which may include credential stores, tool configuration files, or scripts used in automated pipelines.