EUVD-2026-93994
GHSA-695p-3q57-gff4
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Malicious server attacks a client over the network (AV:N) only when the user runs a recursive copy (UI:R) and controls the server (AC:H); impact is limited file write, so C:N/I:L/A:L.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
AnalysisAI
Directory traversal in the OpenSSH sftp client before 10.6 can cause files to be written to unintended locations when a user performs a recursive copy operation against an attacker-controlled or compromised SFTP server. Exploitation requires the victim to initiate a recursive transfer such as get -r or put -r, and the malicious server supplies crafted path/filename entries containing traversal components; this is a client-side trust issue, not a flaw in an exposed sshd service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim's sftp client to perform a recursive copy operation (e.g., 'get -r' or 'put -r') while connected to an attacker-controlled or compromised SFTP server; the malicious server supplies crafted path/filename entries containing traversal components that the client fails to sanitize, writing files to unintended locations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-to-moderate priority issue despite affecting ubiquitous software, and the signals are consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to OpenSSH 10.6 or later, as indicated by the OpenSSH 10.6 release notes at https://www.openssh.org/releasenotes.html#10.6; this is the vendor-released fix for the traversal in sftp recursive copy. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today