Skip to main content

OpenSSH sftp CVE-2026-59995

| EUVDEUVD-2026-42137 MEDIUM
Relative Path Traversal (CWE-23)
2026-07-08 mitre GHSA-2prh-86cw-fm96
5.4
CVSS 3.1 · NVD
Share

Severity by source

Vendor (mitre) PRIMARY
MEDIUM
qualitative
NVD
5.4 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
vuln.today AI
4.2 MEDIUM

AT:P captures the attacker-server prerequisite; UI:A reflects the required active sftp invocation; VC:N/VI:L/VA:L matches bounded file-write impact with no confidentiality loss and no subsequent-system scope change.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
4.2 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Red Hat
5.4 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

3
CVSS changed
Jul 09, 2026 - 17:22 NVD
4.2 (MEDIUM) 5.4 (MEDIUM)
Patch available
Jul 08, 2026 - 02:01 EUVD
Analysis Generated
Jul 08, 2026 - 01:32 vuln.today

DescriptionNVD

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

AnalysisAI

Path traversal in the OpenSSH sftp client before version 10.4p1 allows an attacker-controlled server to write downloaded files outside the user's intended target directory when the 'sftp server:/path .' bulk-download syntax is used. Affected are all OpenSSH deployments where users sftp from untrusted or attacker-controlled hosts, which in practice spans virtually every Linux and Unix environment. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the ubiquity of OpenSSH elevates aggregate exposure despite the moderate per-instance severity.

Technical ContextAI

CWE-23 (Relative Path Traversal) describes the root cause: the sftp client fails to sanitize or constrain server-supplied filenames during bulk downloads. When the user invokes 'sftp server:/path .' the client is expected to restrict all file writes to the current working directory; instead, a malicious server can return filenames containing relative traversal sequences such as '../../.ssh/authorized_keys', causing the client to write files at arbitrary paths reachable by the victim's UID. The vulnerability is confined to the sftp client binary and does not affect sshd, ssh, or scp. The affected CPE is cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* covering all releases prior to 10.4.

RemediationAI

Upgrade to OpenSSH 10.4p1, which includes the fix constraining sftp client download paths; release notes are at https://www.openssh.org/releasenotes.html#10.4p1. For environments where immediate upgrade is not possible, administrators should enforce policy prohibiting use of the 'sftp server:/path .' bulk-download invocation against untrusted or externally controlled servers - note this is a procedural control only, as no technical flag prevents the pattern without patching. Additionally, restricting outbound SFTP connections at the network perimeter to known-trusted servers reduces exposure by eliminating the attacker-controlled-server prerequisite. Security teams should prioritize patching on systems where developers, administrators, or automated scripts routinely sftp from third-party or public hosts, as those are the realistic exploitation scenarios.

More in SSH

View all
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2014-6278 HIGH POC
8.8 Sep 30

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2012-6066 CRITICAL POC
9.3 Dec 04

freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demons

CVE-2014-6277 CRITICAL POC
10.0 Sep 27

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, whi

CVE-2023-25136 MEDIUM POC
6.5 Feb 03

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se

CVE-2016-6210 MEDIUM POC
5.9 Feb 13

sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static

CVE-2015-5600 HIGH POC
8.1 Aug 03

The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin

CVE-2016-6515 HIGH POC
7.5 Aug 07

The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a

CVE-2024-6387 HIGH POC
8.1 Jul 01

Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to

CVE-2012-5975 CRITICAL POC
9.3 Dec 04

The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6

CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-59995 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy