CVE-2026-55201: Evil-WinRM Path Traversal Vulnerability – Patch Guidance

Technical summary

The vulnerability exists in Evil-WinRM's download_dir() function, which processes filenames returned by the Get-ChildItem PowerShell command from a remote Windows server. These filenames are passed unsanitized to File.join(), allowing path traversal sequences to escape the intended download directory. Because the Windows server response is trusted without validation, a compromised or rogue server can inject traversal sequences (e.g., "../../.ssh/authorized_keys") into filename output, causing files to be written to arbitrary locations on the client's filesystem. The fix is available in commit 6ecd570, which presumably sanitizes or validates filenames before file operations.

Business impact

This vulnerability creates a critical supply-chain and endpoint risk for security teams and penetration testers who rely on Evil-WinRM for Windows system administration and red-team operations. A compromised remote server—whether due to an attacker or insider threat—can silently overwrite sensitive client-side credentials, SSH keys, or shell initialization files, granting the attacker persistent foothold or elevated privileges on the analyst's workstation. This is particularly dangerous in environments where analysts interact with untrusted or high-risk Windows systems, as the attack surface is broadened beyond the remote target to the analyst's own machine.

Affected systems

Evil-WinRM versions 3.9 and earlier are affected. The vulnerability requires a scenario where a user is downloading files from a remote Windows system, making it primarily a concern for security professionals, system administrators, and penetration testers who use Evil-WinRM in their daily workflows. The attack surface depends on exposure to rogue or compromised Windows servers that could be queried for file downloads.

Exploitability

The vulnerability requires two conditions: (1) the user must initiate a file download operation via Evil-WinRM's download_dir() function against a remote Windows server, and (2) the remote server must be compromised, rogue, or controlled by an attacker. An attacker cannot exploit this remotely without first compromising or controlling the Windows server being queried. However, once either condition is met, exploitation is straightforward—the attacker simply returns malicious filenames in Get-ChildItem output. The user interaction requirement (initiating a download) limits exposure somewhat, but does not eliminate risk in high-interaction environments like penetration testing labs.

Remediation

Upgrade Evil-WinRM to a version that includes the fix from commit 6ecd570 (versions after 3.9 are presumed to contain this fix; verify against the vendor's release notes). The patch should implement filename sanitization, rejecting or escaping path traversal sequences before passing filenames to file operations. In the interim, minimize downloads from untrusted or high-risk Windows systems, and validate the integrity of downloaded files if possible.

Patch guidance

Apply the update to Evil-WinRM that incorporates commit 6ecd570 once released in a stable version. Verify the patch details against the official Evil-WinRM repository or vendor advisory to confirm the exact version number and installation method. Until patched, consider restricting file downloads to trusted servers or using alternative file-transfer methods (such as direct WinRM copy, SMB, or out-of-band transfer) when interacting with untrusted systems.

Detection guidance

Monitor Evil-WinRM usage for attempts to download files containing path traversal sequences in filenames (e.g., "../", "..\\", or encoded variants). Log and alert on file operations that write outside the intended download directory. Endpoint detection and response (EDR) tools should flag suspicious modification of sensitive files like .ssh/authorized_keys, /etc/passwd, or shell configuration files immediately following Evil-WinRM activity. Network monitoring could detect unusual Get-ChildItem responses returning suspicious filenames, though this requires deep inspection of WinRM traffic.

Why prioritize this

Although rated MEDIUM severity, this vulnerability deserves prioritization for organizations that employ Evil-WinRM, particularly security teams and red teams. The attack leads to privilege escalation and persistent access on analyst workstations—a high-value target for attackers. Additionally, because many analysts may not be aware they are running a vulnerable version, patching should be urgent. The scenario (compromised remote server) is realistic in penetration testing and incident response contexts where analysts interact with already-breached systems.

Risk score, explained

The CVSS 3.1 score of 6.8 (MEDIUM) reflects a high-impact attack (confidentiality and integrity both exploited) but requires user interaction (initiating a download) and a compromised remote server (limiting the attack vector to network access only if the user is downloading from that server). The requirement for user interaction and server compromise prevents a CRITICAL or HIGH rating, but the potential for credential theft and privilege escalation on the client machine justifies a MEDIUM score rather than LOW.

Frequently asked questions