CVE-2006-3015: Winscp

High severity, CVSS 7.1. EPSS: 6.5% chance of exploitation in the next 30 days.

Argument injection vulnerability in WinSCP 3.8.1 build 328 allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote characters in a scp or sftp URI.

Affected products

• Winscp Winscp: version 3.8.1 only

Published 2006-06-14. Last modified 2026-06-16.