CVE-2026-110923: Openssh: openssh: sftp can write outside the destination directory from a server-supplied path
A flaw was found in OpenSSH sftp. During a copy, a server-supplied empty directory entry, a path made only of slashes, or a ".." basename is used as the local destination. The write runs as the user who started sftp, and the server must be one that user chose to copy from. This is an incomplete fix for CVE-2026-59995. That fix only stopped interactiveloop from building a command string. It does not rewrite these destination names. Reserve a new CVE. Do not reuse CVE-2026-59995.
Other sources
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running an SFTP copy from a server they selected are exposed if that server is malicious or compromised. The affected write operation runs with the permissions of the local user who started SFTP.
What must an attacker do to exploit it?
The attacker must control the SFTP server used for the copy and provide a directory entry with an empty name, a path consisting only of slashes, or a basename of "..". SFTP can then use that server-supplied value as a local destination outside the directory selected by the user.
Does this require the attacker to authenticate locally or exploit SFTP without user involvement?
No local privileges are required by the vector shown, but user interaction is required. A user must choose to copy from the malicious server.
Is this the same issue as CVE-2026-59995?
No. This issue is described as an incomplete fix for CVE-2026-59995: the earlier fix prevented interactive_loop from building a command string but did not rewrite unsafe destination names.