---
id: "CVE-2026-111605"
kind: "vulnerability"
aliases: ["CVE-2026-111605"]
title: "Jpom: SSH file controller lets users reach other workspaces' hosts"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "jpom", "package", "self-hosted", "ssh"]
not_affected_if: ["no-ssh-file-features", "single-workspace"]
published_at: "2026-10-16T18:17:39+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:00:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111605", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Jpom: SSH file controller lets users reach other workspaces' hosts

Jpom through 2.11.12 has an authorization bypass in its SshFileController: an authenticated user can supply SSH asset ids belonging to other workspaces. That lets them read, upload, modify, rename and delete files on those foreign SSH hosts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Jpom version and see whether it is `2.11.12` or earlier.
- Confirm whether SSH file management is in use by looking for SSH hosts registered across multiple workspaces.

## Fix

- Upgrade Jpom to a version newer than `2.11.12`; the sources do not name the fixed release, so check the vendor release notes.
- Until patched, restrict SSH file permissions to trusted users only.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111605

## From the sources

Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any workspace can call download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json and new_file_folder.json endpoints to read, modify and delete files on other workspaces' SSH hosts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_