{"id":"CVE-2018-20684","details":"In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.","modified":"2026-05-18T17:44:03.129451Z","published":"2019-01-10T21:29:00.297Z","references":[{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujan2020.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/106526"},{"type":"ADVISORY","url":"https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt"},{"type":"ADVISORY","url":"https://winscp.net/eng/docs/history"},{"type":"FIX","url":"https://github.com/winscp/winscp/commit/49d876f2c5fc00bcedaa986a7cf6dedd6bf16f54"},{"type":"FIX","url":"https://winscp.net/tracker/1675"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/winscp/winscp","events":[{"introduced":"0"},{"last_affected":"d3f40c5aa777f9f8ccf8f49bbd1e10a49deee337"}],"database_specific":{"cpe":"cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"5.13.7"}],"source":"CPE_FIELD"}}],"versions":["5.13.7","5.13.6","5.13.5","5.13.4","5.13.3","5.13.2","5.13.1","5.13","5.12.2","5.11.3","5.11.2","5.11.1","5.11","5.10.4","5.9.6","5.9.5","5.9.4","5.9.3","5.9.2","5.9.1","5.9","5.7.7","5.7.6"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-20684.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}