Vulnerable code sample

import os

def expand_authorized_keys_path(path_template, username):
    """
    This function represents the vulnerable logic from AsyncSSH versions
    prior to the fix for CVE-2026-45309.

    It performs a direct, unsanitized string replacement for the '%u' token,
    which allows a malicious username containing path traversal characters
    ('..', '/', '\') to cause the server to read a file from an
    unintended location.
    """
    # The core of the vulnerability is this direct replacement without sanitation.
    return path_template.replace('%u', username)

# --- Demonstration of the vulnerability in a server context ---

# 1. A server is configured with 'AuthorizedKeysFile' using the %u token.
#    The intent is to scope key files to a specific directory.
server_config_path = 'authorized_keys/%u'

# 2. An attacker provides a malicious username during the SSH handshake.
#    This username is crafted to traverse the filesystem.
malicious_username = '../root/.ssh/authorized_keys'

# 3. The server-side code uses the vulnerable function to determine which
#    authorized_keys file to read for authentication.
resolved_path = expand_authorized_keys_path(server_config_path, malicious_username)

# 4. The resulting path points outside the intended 'authorized_keys/' directory.
#    This would cause the server to attempt to read the root user's authorized_keys
#    file, allowing the attacker to authenticate if they control the key within it.
print(f"Configuration: AuthorizedKeysFile {server_config_path}")
print(f"Malicious Username: '{malicious_username}'")
print(f"Resulting Path to Read: '{resolved_path}'")

# For comparison, a legitimate user 'testuser' would resolve correctly:
legitimate_username = 'testuser'
legitimate_path = expand_authorized_keys_path(server_config_path, legitimate_username)
print(f"\nLegitimate Path for user '{legitimate_username}': '{legitimate_path}'")