# Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980) · pwn.watch

> Charmbracelet Wish (SSH server middleware for Go) before 2.0.5 has a path traversal in the git middleware that lets authenticated SSH users escape the configured repository directory with crafted repo paths. Fixed in v2.0.5 (commit 533db0d). CVSS 8.1 per NVD/VulnCheck.

Page: https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980 · generated 2026-11-06T18:34:57.853Z

## Status
- Severity: high · status: live · patch: patched
- Product: Charmbracelet Wish
- Started: 2026-11-06
- CVEs: CVE-2026-53980
- Affected: charm.land/wish/v2 before 2.0.5
- Fixed in: 2.0.5

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980/feed.xml
- JSON Feed: https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980.json
- This file: https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980/llms.txt

## Updates (newest first)
- 2026-11-06: NVD publishes CVE-2026-53980 for Wish git middleware path traversal; fixed in v2.0.5. (https://nvd.nist.gov/vuln/detail/CVE-2026-53980)
- 2026-11-06: Wish v2.0.5 release notes include fix(git): confine repo names to the repo dir. (https://github.com/charmbracelet/wish/releases/tag/v2.0.5)

## Fix brief
# Security brief: Charmbracelet Wish before 2.0.5: git middleware path traversal (CVE-2026-53980)

Source: https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980 · status: live · severity: high · updated Nov 6, 2026, 16:19 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Charmbracelet Wish (SSH server middleware for Go) before 2.0.5 has a path traversal in the git middleware that lets authenticated SSH users escape the configured repository directory with crafted repo paths. Fixed in v2.0.5 (commit 533db0d). CVSS 8.1 per NVD/VulnCheck.

Severity detail: CVSS 8.1; authenticated SSH users can escape the configured git repo directory

- Product: Charmbracelet Wish
- CVE / advisory ids: CVE-2026-53980

## Affected versions
- charm.land/wish/v2 before 2.0.5

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 2.0.5

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Nov 6, 2026: NVD publishes CVE-2026-53980 for Wish git middleware path traversal; fixed in v2.0.5.
- Nov 6, 2026: Wish v2.0.5 release notes include fix(git): confine repo names to the repo dir.

## Advisories
- [NVD: CVE-2026-53980](https://nvd.nist.gov/vuln/detail/CVE-2026-53980) (NVD)
- [Wish v2.0.5 release](https://github.com/charmbracelet/wish/releases/tag/v2.0.5) (Charmbracelet)
- [Fix commit 533db0d](https://github.com/charmbracelet/wish/commit/533db0daa90446b0d4ae3284877179c37e0cc48e) (Charmbracelet)

## Caveats
Authenticated SSH required. Separate from SCP sibling-directory fix also in 2.0.5.

---
Machine-readable: https://pwn.watch/i/charmbracelet-wish-git-middleware-path-traversal-cve-2026-53980.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.