PowerShell · Dongbo Wang (daxian-dbw) · Sep 11, 2026 · Sep 1, 2026
@@ -4106,6 +4106,14 @@ private void CopyDirectoryFromRemoteSession(
 
             if (IsItemContainer(destination))
             {
+                if (CanRemoteNameCausePathTraversal(sourceDirectoryName))
+                {
+                    throw PSTraceSource.NewArgumentException(
+                        nameof(sourceDirectoryName),
+                        FileSystemProviderStrings.DirectoryNamePathTraversal,
+                        sourceDirectoryName);
+                }
+
                 destination = MakePath(destination, sourceDirectoryName);
             }
 
@@ -4341,6 +4349,14 @@ private void CopyFileFromRemoteSession(
             // to the destination path.
             if (IsItemContainer(destinationPath))
             {
+                if (CanRemoteNameCausePathTraversal(sourceFileName))
+                {
+                    throw PSTraceSource.NewArgumentException(
+                        nameof(sourceFileName),
+                        FileSystemProviderStrings.FileNamePathTraversal,
+                        sourceFileName);
+                }
+
                 destinationPath = MakePath(destinationPath, sourceFileName);
             }
 
@@ -4368,6 +4384,11 @@ private void CopyFileFromRemoteSession(
                     {
                         foreach (string streamName in remoteFileStreams)
                         {
+                            if (CanRemoteNameCausePathTraversal(streamName))
+                            {
+                                throw PSTraceSource.NewArgumentException(nameof(streamName), FileSystemProviderStrings.ADSPathTraversal, streamName);
+                            }
+
                             result = PerformCopyFileFromRemoteSession(sourceFileFullName, destinationFile, destinationPath, force, ps, fileSize, true, streamName);
                             if (!result)
                             {
@@ -4963,6 +4984,30 @@ private bool PathIsReservedDeviceName(string destinationPath, string errorId)
             return pathIsReservedDeviceName;
         }
 
+        /// <summary>
+        /// Check if a file/directory name or an alternate stream name is a plain name that does not contain any characters that could allow path traversal.
+        /// </summary>
+        private static bool CanRemoteNameCausePathTraversal(string name)
+        {
+            if (string.IsNullOrEmpty(name))
+            {
+                // 'MakePath' handles null or empty value, so we just let it flow through.
+                return false;
+            }
+
+            // Detect characters and name patterns that could enable path traversal.
+            return name.IndexOfAny(s_pathTraversalChars) >= 0 || name is "." or "..";
+        }
+
+        // Characters that must never appear in a remote-supplied file system item name or an alternate stream name
+        // because we expect a plain name, not a path, and we don't want to allow any path traversal.
+        private static readonly char[] s_pathTraversalChars =
+#if UNIX
+            ['\\', '/'];
+#else
+            ['\\', '/', ':'];
+#endif
+
         private long _totalFiles;
         private long _totalBytes;
         private long _copiedFiles;

@@ -240,6 +240,15 @@
   <data name="TargetCannotContainDeviceName" xml:space="preserve">
     <value>Cannot process path '{0}' because the target represents a reserved device name.</value>
   </data>
+  <data name="DirectoryNamePathTraversal" xml:space="preserve">
+    <value>Cannot process the remote directory name '{0}' because it may result in path traversal.</value>
+  </data>
+  <data name="FileNamePathTraversal" xml:space="preserve">
+    <value>Cannot process the remote file name '{0}' because it may result in path traversal.</value>
+  </data>
+  <data name="ADSPathTraversal" xml:space="preserve">
+    <value>Cannot process the remote Alternate Data Stream name '{0}' because it may result in path traversal.</value>
+  </data>
   <data name="EncodingNotUsed" xml:space="preserve">
     <value>Encoding not used when '-AsByteStream' specified.</value>
   </data>

@@ -2,6 +2,17 @@
 # Licensed under the MIT License.
 
 Describe "Validate Copy-Item locally" -Tags "CI" {
+    BeforeAll {
+        $canRemoteNameCausePathTraversalMethod = [Microsoft.PowerShell.Commands.FileSystemProvider].GetMethod(
+            'CanRemoteNameCausePathTraversal',
+            [System.Reflection.BindingFlags]::NonPublic -bor [System.Reflection.BindingFlags]::Static)
+
+        function CanRemoteNameCausePathTraversal {
+            param ([string]$name)
+            return $canRemoteNameCausePathTraversalMethod.Invoke($null, @($name))
+        }
+    }
+
     It "Copy-Item has non-terminating error if destination is in use" -Skip:(!$IsWindows) {
         Copy-Item -Path $env:windir\system32\cmd.exe -Destination TestDrive:\
         $cmd = Start-Process -FilePath TestDrive:\cmd.exe -PassThru
@@ -12,6 +23,34 @@ Describe "Validate Copy-Item locally" -Tags "CI" {
             $cmd | Stop-Process
         }
     }
+
+    It "Validate remote name <Name> for path traversal" -TestCases @(
+        @{ Name = "evil.txt"; CanTraverse = $false }
+        @{ Name = "my.file.name"; CanTraverse = $false }
+        @{ Name = "Zone.Identifier"; CanTraverse = $false }
+        @{ Name = "has space.txt"; CanTraverse = $false }
+        @{ Name = "COM10"; CanTraverse = $false }
+
+        @{ Name = ".."; CanTraverse = $true }
+        @{ Name = "."; CanTraverse = $true }
+        @{ Name = "..\..\evil.txt"; CanTraverse = $true }
+        @{ Name = "a\b"; CanTraverse = $true }
+        @{ Name = "a/b"; CanTraverse = $true }
+        @{ Name = "\evil"; CanTraverse = $true }
+        @{ Name = "C:\evil"; CanTraverse = $true }
+        @{ Name = "..\"; CanTraverse = $true }
+
+        ## The char ':' is not allowed on Windows, but allowed on Unix platforms.
+        @{ Name = "x:evil"; CanTraverse = $isWindows }
+        @{ Name = ":bad"; CanTraverse = $isWindows }
+    ) {
+        param(
+            [string]$Name,
+            [bool]$CanTraverse
+        )
+
+        CanRemoteNameCausePathTraversal $Name | Should -Be $CanTraverse
+    }
 }
 
 # This is a Pester test suite to validate Copy-Item remotely using a remote session.