CVE-2026-110923: Openssh: openssh: sftp can write outside the destination directory from a server-supplied path
A flaw was found in OpenSSH sftp. During a copy, a server-supplied empty directory entry, a path made only of slashes, or a ".." basename is used as the local destination. The write runs as the user who started sftp, and the server must be one that user chose to copy from. This is an incomplete fix for CVE-2026-59995. That fix only stopped interactiveloop from building a command string. It does not rewrite these destination names. Reserve a new CVE. Do not reuse CVE-2026-59995.
Other sources
CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552.
— Launchpad
Openssh: openssh: sftp can write outside the destination directory from a server-supplied path
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running an SFTP copy from a server they selected are exposed if that server is malicious or compromised. The affected write operation runs with the permissions of the local user who started SFTP.
What must an attacker do to exploit it?
The attacker must control the SFTP server used for the copy and provide a directory entry with an empty name, a path consisting only of slashes, or a basename of "..". SFTP can then use that server-supplied value as a local destination outside the directory selected by the user.
Does this require the attacker to authenticate locally or exploit SFTP without user involvement?
No local privileges are required by the vector shown, but user interaction is required. A user must choose to copy from the malicious server.
Is this the same issue as CVE-2026-59995?
No. This issue is described as an incomplete fix for CVE-2026-59995: the earlier fix prevented interactive_loop from building a command string but did not rewrite unsafe destination names.