CVE-2026-106552
published 2026-10-06CVE-2026-106552: In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy…
PriorityP336medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EPSS
0.36%
28.3th percentile
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | < 10.6 | 10.6 |
| openbsd | openssh | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| ubuntu | openssh | — | — |
| ubuntu | openssh-gssapi | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vendor_redhat6.5MEDIUM
vendor_ubuntu6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-19·CVSS 6.5
CVE-2026-106553 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote attacker
controlling the server could possibly use this issue to write files to
unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous failed
authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-10-14·CVSS 6.5
CVE-2026-106552 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH's sftp client incorrectly handled paths
returned by the server during a recursive copy operation. A remote
attacker controlling the server could possibly use this issue to write
files to unintended locations. (CVE-2026-106552)
It was discovered that OpenSSH's sshd server incorrectly handled
GSSAPIAuthentication state across authentication attempts. An attacker
could possibly use this issue to obtain credentials from a previous
failed authentication attempt. (CVE-2026-106553, CVE-2026-106555)
It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder
during compression. An attacker could possibly use this issue to obtain
sensitive information. (CVE-2026-106
Red Hat
openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy
vendor_redhat·2026-10-06·CVSS 6.5
CVE-2026-106552 [MEDIUM] CWE-22 openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy
openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
A flaw was found in OpenSSH. A malicious or compromised server can write files to unintended locations on a client system during a recursive copy operation using the SFTP (Secure File Transfer Protocol) client. By returning crafted file paths, the remote server can trigger a directory traversal and force the client to store files outside the designated destination directory, potentially overwriting existing local files.
Statement: A flaw was found in the OpenSSH sftp client, rated moderate severity by Red Hat Product Security. When a user
GHSA
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
ghsa_unreviewed·2026-10-06
CVE-2026-106552 [MEDIUM] CWE-23 In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-106552 openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy [fedora-all]
bugzilla·2026-10-19·CVSS 6.5
CVE-2026-106552 [MEDIUM] CVE-2026-106552 openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy [fedora-all]
CVE-2026-106552 openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
Bugzilla
CVE-2026-106552 openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy
bugzilla·2026-10-06·CVSS 6.5
CVE-2026-106552 [MEDIUM] CVE-2026-106552 openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy
CVE-2026-106552 openssh: openssh: Arbitrary file write via directory traversal during sftp recursive copy
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
2026-10-06
Published