OpenSSH sftp EUVD-2026-42137

Exploitation requires two simultaneous conditions: (1) the victim must actively invoke the sftp client using the specific 'sftp server:/path .' bulk-download syntax - not a passive or background operation - and (2) the server must be attacker-controlled or interceptable via MITM. The vulnerability does not affect passive sftp sessions, sshd, ssh login, or scp. File writes are bounded by the operating system permissions of the victim's process (typically user UID), meaning root-owned files cannot be overwritten unless the victim is running sftp as root. Non-default deployment is not a factor - the vulnerability is present in any standard OpenSSH sftp client install prior to 10.4p1 when the described usage pattern occurs. UI:R in the CVSS vector confirms user interaction is required and passive, opportunistic exploitation against idle systems is not possible.

The NVD CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) accurately reflects a meaningful but bounded threat. High attack complexity (AC:H) requires the attacker to control or impersonate the SFTP server, and required user interaction (UI:R) means a victim must actively initiate the sftp session with the specific bulk-download syntax. The impact is limited to integrity and availability (no confidentiality loss), and file writes are further constrained by the victim's operating system permissions. EPSS data is not yet available for this newly disclosed CVE, and no CISA KEV listing or public exploit code exists at time of analysis. Despite the low per-instance score, the ubiquity of OpenSSH across production Linux infrastructure warrants prompt patching - a file write primitive against ssh configuration files or cron directories could serve as a privilege escalation stepping stone in chained attacks.

An attacker stands up a malicious SFTP server and entices a victim to download files using 'sftp attacker-server:/files .' - achievable via phishing, DNS poisoning, or BGP hijack. The malicious server returns filenames prefixed with path traversal sequences, causing the sftp client to silently write files such as a backdoored ~/.ssh/authorized_keys or a cron job outside the victim's intended download directory. No public exploit code has been identified at time of analysis, but the technique is straightforward to implement by any operator of a malicious SFTP service.