CVE-2018-20684: Winscp

High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days.

In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelated files. This affects TSCPFileSystem::SCPSink in core/ScpFileSystem.cpp.

Affected products

• Winscp Winscp: up to and including 5.13.7

Published 2019-01-10. Last modified 2026-06-17.