REDHAT-BUG-2553028: Medium severity OpenSSH sftp vulnerability
A flaw was found in OpenSSH sftp. During a copy, a server-supplied empty directory entry, a path made only of slashes, or a ".." basename is used as the local destination. The write runs as the user who started sftp, and the server must be one that user chose to copy from. This is an incomplete fix for CVE-2026-59995. That fix only stopped interactiveloop from building a command string. It does not rewrite these destination names. Reserve a new CVE. Do not reuse CVE-2026-59995.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this flaw?
Users who run OpenSSH sftp copies from a server they selected may be exposed. The affected write operation runs with the permissions of the local user who started sftp.
What does an attacker need to exploit it?
The attacker needs to control, or cause the user to copy from, the selected SFTP server. The server must supply a malicious directory entry such as an empty name, a path consisting only of slashes, or a basename of ".." during a copy operation.
Does the prior fix for CVE-2026-59995 fully address this issue?
No. That fix prevented interactive_loop from constructing a command string, but it did not rewrite these server-supplied destination names.