PT-2026-56286

CVE-2026-59995

·

Published

2026-07-08

·

Updated

2026-10-30

Description by

CVSS 3.1
5.4
Medium
MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.4
Description The sftp client does not properly constrain the location of downloaded files when the command sftp server:/path . is used to connect to an attacker-controlled server.
Recommendations Update to version 10.4 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-23: Relative Path Traversal
Related identifiers
CVE-2026-59995
ALSA-2026:69129
ALSA-2026:69130
ALSA-2026:69266
AZL-92042
CLSA-2026-1784280067
CLSA-2026-1784297006
ECHO-086A-CD07-BC73
JLSEC-2026-1319
OESA-2026-3349
OESA-2026-3350
OESA-2026-3351
OESA-2026-3352
OESA-2026-3428
OPENSUSE-SU-2026:21477-1
RHSA-2026:37382
RHSA-2026:69129
RHSA-2026:69130
RHSA-2026:69266
SUSE-SU-2026:22978-1
SUSE-SU-2026:24382-1
SUSE-SU-2026:24478-1
SUSE-SU-2026:3605-1
SUSE-SU-2026:4907-1
USN-8533-1
USN-8804-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com