CVE-2026-59995
published 2026-07-08CVE-2026-59995: sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
PriorityP429medium5.4CVSS 3.1
AVNACLPRNUIRSUCNILAL
EPSS
0.25%
15.4th percentile
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openbsd | openssh | < 10.4 | 10.4 |
| openbsd | openssh | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| ubuntu | openssh | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
vendor_ubuntu8.1HIGH
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
ghsa_unreviewed·2026-07-08
CVE-2026-59995 [MEDIUM] CWE-23 sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
VulDB
OpenBSD OpenSSH up to 10.3 SFTP path traversal
vuldb·2026-07-08·CVSS 4.2
CVE-2026-59995 [MEDIUM] OpenBSD OpenSSH up to 10.3 SFTP path traversal
A vulnerability identified as critical has been detected in OpenBSD OpenSSH up to 10.3. Affected is an unknown function of the component SFTP. Performing a manipulation results in path traversal.
This vulnerability is cataloged as CVE-2026-59995. It is possible to initiate the attack remotely. There is no exploit available.
Red Hat
openssh: openssh: sftp can write outside the destination directory from a server-supplied path
vendor_redhat·2026-10-15·CVSS 6.5
CVE-2026-110923 [MEDIUM] CWE-22 openssh: openssh: sftp can write outside the destination directory from a server-supplied path
openssh: openssh: sftp can write outside the destination directory from a server-supplied path
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.
Statement: This issue is an incomplete fix for CVE-2026-59995. A user who copies files from an untrusted sftp server can have files written outside the destination directory they selected. The write is performed as that user.
Mitigation: Do not use sftp to copy from a server you do not trust. There is no configuration switch that closes this path.
Package: openssh (Red Hat Enterprise Linux 10) - Affected
Package: openssh (Red Hat Enterprise Linux 6) - Affected
Package: op
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 8.1
CVE-2026-73282 [HIGH] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
Florian Kohnhäuser discovered that OpenSSH incorrectly handled shell
metacharacters in certain usernames. An attacker could possibly use this
issue to execute arbitrary commands when certain non-default
configurations were used, resulting in arbitrary code execution. This
issue only affected Ubuntu 14.04 LTS. (CVE-2026-35386)
Christos Papakonstantinou discovered that OpenSSH incorrectly handled
ECDSA algorithm restrictions. An attacker could possibly use this issue
to cause unintended ECDSA algorithms to be accepted, resulting in
security restrictions being bypassed. (CVE-2026-35387)
Vladimir Tokarev discovered that OpenSSH incorrectly handled certain
principal restrictions in authorized_keys files.
Ubuntu
OpenSSH vulnerabilities
vendor_ubuntu·2026-07-13·CVSS 5.4
CVE-2026-60001 [MEDIUM] OpenSSH vulnerabilities
Title: OpenSSH vulnerabilities
Summary: Several security issues were fixed in OpenSSH.
It was discovered that OpenSSH sftp did not properly constrain the location
of downloaded files when connecting to an attacker-controlled server. An
attacker could possibly use this issue to write files to unintended
locations on the file system. (CVE-2026-59995)
It was discovered that OpenSSH scp could place files in the parent
directory of the intended destination when copying between two remote
hosts. An attacker could possibly use this issue to write files to
unintended locations. (CVE-2026-59996)
It was discovered that OpenSSH internal-sftp only recognized the first nine
command-line arguments, This could result in certain security-sensitive
arguments being ignored, contrary to expectations. (CV
Red Hat
openssh: OpenSSH: sftp client allows attacker to control downloaded file location
vendor_redhat·2026-07-08·CVSS 4.2
CVE-2026-59995 [MEDIUM] CWE-22 openssh: OpenSSH: sftp client allows attacker to control downloaded file location
openssh: OpenSSH: sftp client allows attacker to control downloaded file location
A flaw was found in OpenSSH. The `sftp` client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or placing malicious files in sensitive directories on the client system, which could compromise system integrity.
Package: openssh (Red Hat Enterprise Linux 10) - Fix deferred
Package: openssh (Red Hat Enterprise Linux 6) - Fix deferred
Package: openssh (Red Hat Enterprise Linux 7) - Fix deferred
Package: openssh (Red Hat Enterprise Linux 8) - Fix deferred
Package: openssh (Red Hat Enterprise Linux 9) - Fix deferre
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-110923 openssh: openssh: sftp can write outside the destination directory from a server-supplied path [fedora-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-110923 [MEDIUM] CVE-2026-110923 openssh: openssh: sftp can write outside the destination directory from a server-supplied path [fedora-all]
CVE-2026-110923 openssh: openssh: sftp can write outside the destination directory from a server-supplied path [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A flaw was found in OpenSSH sftp. During a copy, a server-supplied empty directory entry, a path made only of slashes, or a ".." basename is used as the local destination. The write runs as the user who started sftp, and the server must be one that user chose to copy from. This is an incomplete fix for CVE-2026-59995. That fix only stopped interactive_loop from building a command string. It does not rewrite these destination names. Reserve a new
Bugzilla
CVE-2026-110923 openssh: openssh: sftp can write outside the destination directory from a server-supplied path
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-110923 [MEDIUM] CVE-2026-110923 openssh: openssh: sftp can write outside the destination directory from a server-supplied path
CVE-2026-110923 openssh: openssh: sftp can write outside the destination directory from a server-supplied path
A flaw was found in OpenSSH sftp. During a copy, a server-supplied empty directory entry, a path made only of slashes, or a ".." basename is used as the local destination. The write runs as the user who started sftp, and the server must be one that user chose to copy from. This is an incomplete fix for CVE-2026-59995. That fix only stopped interactive_loop from building a command string. It does not rewrite these destination names. Reserve a new CVE. Do not reuse CVE-2026-59995.
Bugzilla
CVE-2026-59995 openssh: OpenSSH: sftp client allows attacker to control downloaded file location [fedora-all]
bugzilla·2026-09-11·CVSS 5.4
CVE-2026-59995 [MEDIUM] CVE-2026-59995 openssh: OpenSSH: sftp client allows attacker to control downloaded file location [fedora-all]
CVE-2026-59995 openssh: OpenSSH: sftp client allows attacker to control downloaded file location [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
Bugzilla
CVE-2026-59995 openssh: OpenSSH: sftp client allows attacker to control downloaded file location
bugzilla·2026-07-08·CVSS 4.2
CVE-2026-59995 [MEDIUM] CVE-2026-59995 openssh: OpenSSH: sftp client allows attacker to control downloaded file location
CVE-2026-59995 openssh: OpenSSH: sftp client allows attacker to control downloaded file location
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
2026-07-08
Published