{"uuid": "dd474f4d-460b-4d5a-9cf8-f59d33c9c4de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-59995", "type": "seen", "source": "https://gist.github.com/alon710/44be7e1a209e5efdfe9c767d3a86a09b", "content": "# CVE-2026-59995: CVE-2026-59995: Relative Path Traversal in OpenSSH sftp Client\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-07-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59995\n\n## Summary\nA relative path traversal vulnerability (CWE-23) in the client-side sftp utility of OpenSSH before version 10.4 allows malicious or compromised SFTP servers to write or overwrite files outside the intended destination directory when a user executes a direct one-shot download command.\n\n## TL;DR\nOpenSSH sftp clients prior to 10.4 are vulnerable to relative path traversal, allowing a compromised SFTP server to write arbitrary files on the client system during command-line downloads.\n\n## Technical Details\n\n- **CWE ID**: CWE-23\n- **Attack Vector**: Network\n- **CVSS Score**: 4.2 (Medium)\n- **EPSS Score**: 0.0025 (16.73%)\n- **Impact**: Low Integrity, Low Availability\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenSSH sftp client prior to version 10.4\n- **OpenSSH sftp**: < 10.4 (Fixed in: `10.4`)\n\n## Mitigation\n\n- Upgrade client-side OpenSSH to version 10.4 or higher.\n- Avoid using direct, one-shot download syntax: sftp server:/path .\n- Establish restrictive client-side file access policies or use isolation/sandboxing techniques.\n\n**Remediation Steps:**\n1. Identify the local OpenSSH sftp version using 'sftp -V'.\n2. Apply system package updates using the local package manager (apt, dnf, yum) to update openssh-client or openssh-clients to 10.4 or above.\n3. In environments where updates are blocked, implement AppArmor or SELinux policies to restrict the write directories of the sftp binary.\n\n## References\n\n- [NVD CVE-2026-59995 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-59995)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-59995)\n- [OpenSSH 10.4 Official Release Notes](https://www.openssh.org/releasenotes.html#10.4p1)\n- [oss-security Mailing List Release Announcement](https://www.openwall.com/lists/oss-security/2026/07/06/5)\n- [OpenSSH UNIX Dev Mailing List Archive](https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2)\n- [Wiz Vulnerability Database Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-59995)\n- [OSV JSON Entry](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59995.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59995) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T16:32:54.579911Z"}