Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980) ยท updates https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980 Charmbracelet Wish (SSH server middleware for Go) before 2.0.5 has a path traversal in the git middleware that lets authenticated SSH users escape the configured repository directory with crafted repo paths. Fixed in v2.0.5 (commit 533db0d). CVSS 8.1 per NVD/VulnCheck. en Fri, 06 Nov 2026 00:00:00 GMT Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980): NVD publishes CVE-2026-53980 for Wish git middleware path traversal; fixed in v2.0.5. https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980 https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980#2026-11-06-b6b02833 Fri, 06 Nov 2026 00:00:00 GMT high <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-53980">Source</a></p> Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980): Wish v2.0.5 release notes include fix(git): confine repo names to the repo dir. https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980 https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980#2026-11-06-03b375d4 Fri, 06 Nov 2026 00:00:00 GMT high <p><a href="https://github.com/charmbracelet/wish/releases/tag/v2.0.5">Source</a></p>