CVE-2018-20684

HIGH 7.5CVE-2018-20684 · Published 10/01/2019 · updated 17/06/2026

In short

CVE-2018-20684 is a HIGH (CVSS 7.5) vulnerability affecting winscp (winscp).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
winscp winscp	`≤ 5.13.7`	No fix yet

Description

In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.

References

securityfocus.com/bid/106526 · Third Party Advisory
winscp/winscp commit 49d876f · Patch
sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt · Mitigation
winscp.net/eng/docs/history · Release Notes
winscp.net/tracker/1675 · Patch
oracle.com/security-alerts/cpujan2020.html

More vulnerabilities in winscp

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

winscp

≤ 5.13.7

No fix yet

More vulnerabilities in winscp

See all →