CVE-2018-20684

7.5 highEPSS 2.8%

High (7.5) in winscp winscp. EPSS 2.8% chance of exploitation in the next 30 days.

In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2019-01-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

winscp:winscp

References

http://www.securityfocus.com/bid/106526
https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
https://winscp.net/eng/docs/history
https://winscp.net/tracker/1675

Check your stack JSON