CVE-2026-47187

Name of the Vulnerable Software and Affected Versions SSHFS versions prior to 3.7.6

Description A rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components. SSHFS passes these through FUSE (Filesystem in Userspace) for resolution by the client kernel against the local filesystem. The transform symlink() function returns early, while sshfs readlink() copies the server-supplied link target to the kernel. A victim or tool following such a link through operations like cp, rsync, or backup tooling can disclose readable local files to the server or allow the server to write content to writable local files, including startup or scheduled-task files.

Recommendations Update to version 3.7.6.