OpenSSH sftp client EUVD-2026-101835

Exploitation requires the victim to use the OpenSSH sftp client to perform a copy/download from an attacker-controlled or compromised SFTP server; the malicious server then supplies a crafted remote name (empty string, slash-only path, or a basename containing '..') that the client uses verbatim as the local destination. Limiting factors: it is purely client-side and demands user interaction (the user must initiate the sftp copy), requires connecting to a hostile/untrusted server (not triggerable against trusted or default server usage), and yields only unauthorized file writes outside the chosen directory (integrity) with no confidentiality or availability impact. Users who only transfer files with trusted servers are not realistically exposed.

This is a client-side path-traversal (CWE-22) in the OpenSSH sftp client, rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) with impact limited to integrity (I:H; C:N/A:N). The CVSS vector is network (AV:N) and nominally unauthenticated (PR:N), but it critically requires user interaction (UI:R): the victim must actively initiate an sftp copy against a malicious or compromised server. This is not a server-side remote code execution - the 'attacker' is the SSH server the client chose to connect to, which is a meaningful trust inversion but a much narrower precondition than AV:N alone suggests. No EPSS score, CISA KEV listing, SSVC decision data, or public POC is present in the provided intelligence, so there is no evidence of active exploitation. The realistic risk is moderate and conditional: it matters most where users routinely pull files from untrusted or potentially hostile SFTP endpoints. Note a signal tension - PR:N implies no authentication, yet real-world exploitation depends on the social/operational step of connecting to and copying from an attacker-controlled server, so the raw AV:N/PR:N framing overstates spray-and-pray exploitability; treat UI:R as the dominant limiting factor.

A user runs the sftp client and downloads files from a server the attacker controls or has compromised. The malicious server responds to the copy with a crafted name - empty, slash-only, or containing a '..' basename - which the client uses as the local destination, causing the file to be written outside the directory the user selected (e.g., overwriting a config or dotfile in the user's home or a parent path). No public exploit code is identified in the provided data, but the technique is simple and requires only a hostile server plus a user-initiated copy.