CVE-2016-5725

🗓️ 19 Jan 2017 22:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 138 Views🌐 WEB

Directory traversal vuln in JCraft JSch before 0.1.54 on Window

Reporter	Title	Published	Views	Family All 49
0day.today	JCraft / JSch Java Secure Channel 0.1.53 - Recursive sftp-get Directory Traversal	22 Sep 201600:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM System Networking Switch Center is affected by a Jsch vulnerability (CVE-2016-5725)	31 Jan 201902:25	–	ibm
IBM Security Bulletins	Security Bulletin: JSch could allow a remote attacker to traverse directories on the system which affects watsonx.data	10 Mar 202518:07	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in IBM WebSphere Application (CVE-2016-5725) affects IBM PowerVM Novalink.	21 Oct 202518:04	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilties have been addressed in IBM Cognos Analytics	13 Sep 201916:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities have been fixed in IBM Security Privileged Identity Manager Appliance.	17 Sep 201915:34	–	ibm
IBM Security Bulletins	Security Bulletin: ITCAM for Transactions affected by the Security vulnerability CVE-2016-5725 found in jsch-0.1.40.jar	30 Aug 202315:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Fasterxml Jackson,FasterXML Jackson Core,Bouncy Castle Java, Netty,Hibernate Validator,JCraft JSch,Apache Tomcat,Bootstrap might affect IBM Storage Defender Copy Data Management	12 Dec 202515:28	–	ibm
IBM Security Bulletins	Security Bulletin: Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE	29 Mar 202121:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities identified in IBM StoredIQ	20 Feb 202012:42	–	ibm

NVD

Node

jcraft jschRange≤0.1.53

AND

microsoft windows

Source	Link
github	www.github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725
exploit-db	www.exploit-db.com/exploits/40411/
oracle	www.oracle.com/security-alerts/cpuoct2020.html
packetstormsecurity	www.packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.html
oracle	www.oracle.com/security-alerts/cpujan2021.html
securityfocus	www.securityfocus.com/bid/93100
jcraft	www.jcraft.com/jsch/ChangeLog
seclists	www.seclists.org/fulldisclosure/2016/Sep/53
lists	www.lists.debian.org/debian-lts-announce/2020/04/msg00017.html
oracle	www.oracle.com/security-alerts/cpuApr2021.html

Parameter	Position	Path	Description	CWE
fancyfolder	path	fancyfolder//..\..\totally_malicious_script	Recursive SFTP get traversal leading to writing outside download base dir	CWE-22
..\\..\\totally_malicious_script	path	fancyfolder//..\..\totally_malicious_script	Recursive SFTP get traversal leading to writing outside download base dir	CWE-22

13 May 2026 00:24Current

5.7Medium risk

Vulners AI Score5.7

CVSS 24.3

CVSS 35.9

EPSS0.26672

CWE-22