DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-59995: CVE-2026-59995: Relative Path Traversal in OpenSSH sftp Client

#security #cve #cybersecurity

CVE-2026-59995: Relative Path Traversal in OpenSSH sftp Client

Vulnerability ID: CVE-2026-59995
CVSS Score: 4.2
Published: 2026-07-08

A relative path traversal vulnerability (CWE-23) in the client-side sftp utility of OpenSSH before version 10.4 allows malicious or compromised SFTP servers to write or overwrite files outside the intended destination directory when a user executes a direct one-shot download command.

TL;DR

OpenSSH sftp clients prior to 10.4 are vulnerable to relative path traversal, allowing a compromised SFTP server to write arbitrary files on the client system during command-line downloads.

Technical Details

  • CWE ID: CWE-23
  • Attack Vector: Network
  • CVSS Score: 4.2 (Medium)
  • EPSS Score: 0.0025 (16.73%)
  • Impact: Low Integrity, Low Availability
  • Exploit Status: None
  • KEV Status: Not Listed

Affected Systems

  • OpenSSH sftp client prior to version 10.4
  • OpenSSH sftp: < 10.4 (Fixed in: 10.4)

Mitigation Strategies

  • Upgrade client-side OpenSSH to version 10.4 or higher.
  • Avoid using direct, one-shot download syntax: sftp server:/path .
  • Establish restrictive client-side file access policies or use isolation/sandboxing techniques.

Remediation Steps:

  1. Identify the local OpenSSH sftp version using 'sftp -V'.
  2. Apply system package updates using the local package manager (apt, dnf, yum) to update openssh-client or openssh-clients to 10.4 or above.
  3. In environments where updates are blocked, implement AppArmor or SELinux policies to restrict the write directories of the sftp binary.

References

Read the full report for CVE-2026-59995 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)