{"vulnerability": "CVE-2026-59995", "sightings": [{"uuid": "dd474f4d-460b-4d5a-9cf8-f59d33c9c4de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-59995", "type": "seen", "source": "https://gist.github.com/alon710/44be7e1a209e5efdfe9c767d3a86a09b", "content": "# CVE-2026-59995: CVE-2026-59995: Relative Path Traversal in OpenSSH sftp Client\n\n> **CVSS Score:** 4.2\n> **Published:** 2026-07-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59995\n\n## Summary\nA relative path traversal vulnerability (CWE-23) in the client-side sftp utility of OpenSSH before version 10.4 allows malicious or compromised SFTP servers to write or overwrite files outside the intended destination directory when a user executes a direct one-shot download command.\n\n## TL;DR\nOpenSSH sftp clients prior to 10.4 are vulnerable to relative path traversal, allowing a compromised SFTP server to write arbitrary files on the client system during command-line downloads.\n\n## Technical Details\n\n- **CWE ID**: CWE-23\n- **Attack Vector**: Network\n- **CVSS Score**: 4.2 (Medium)\n- **EPSS Score**: 0.0025 (16.73%)\n- **Impact**: Low Integrity, Low Availability\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- OpenSSH sftp client prior to version 10.4\n- **OpenSSH sftp**: < 10.4 (Fixed in: `10.4`)\n\n## Mitigation\n\n- Upgrade client-side OpenSSH to version 10.4 or higher.\n- Avoid using direct, one-shot download syntax: sftp server:/path .\n- Establish restrictive client-side file access policies or use isolation/sandboxing techniques.\n\n**Remediation Steps:**\n1. Identify the local OpenSSH sftp version using 'sftp -V'.\n2. Apply system package updates using the local package manager (apt, dnf, yum) to update openssh-client or openssh-clients to 10.4 or above.\n3. In environments where updates are blocked, implement AppArmor or SELinux policies to restrict the write directories of the sftp binary.\n\n## References\n\n- [NVD CVE-2026-59995 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-59995)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-59995)\n- [OpenSSH 10.4 Official Release Notes](https://www.openssh.org/releasenotes.html#10.4p1)\n- [oss-security Mailing List Release Announcement](https://www.openwall.com/lists/oss-security/2026/07/06/5)\n- [OpenSSH UNIX Dev Mailing List Archive](https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2)\n- [Wiz Vulnerability Database Profile](https://www.wiz.io/vulnerability-database/cve/cve-2026-59995)\n- [OSV JSON Entry](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59995.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59995) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-21T16:32:54.579911Z"}, {"uuid": "a60713c2-9996-4efa-b167-187788f4262b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59995", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq47zpcevu24", "content": "CVE-2026-59995 - OpenSSH SFTP Path Traversal Vulnerability\nCVE ID : CVE-2026-59995\n \n Published : July 8, 2026, 1:16 a.m. | 2\u00a0hours, 32\u00a0minutes ago\n \n Description : sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path...", "creation_timestamp": "2026-07-08T03:56:51.913000Z"}, {"uuid": "87eb63d0-598a-4824-a116-b3dae4232b2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59995", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y", "content": "OpenSSH\u306e\u8106\u5f31\u6027(Moderate: CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59998, CVE-2026-59999)\u3068OpenSSH 10.4/10.4p1\u30ea\u30ea\u30fc\u30b9\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #linux #openssh #ssh\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-07-08T22:47:27.116547Z"}, {"uuid": "17743ea9-80fc-4a35-98d2-341936e24372", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59995", "type": "seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mqbbbatvik2g", "content": "MEDIUM severity CVE just published in OpenSSH:\n\nCVE-2026-59995. sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when \"sftp server:/path .\" is used with an attacker-controlled server.\n\nnvd.nist.gov/vuln/detail/CVE-2026-59995", "creation_timestamp": "2026-07-10T04:02:17.297972Z"}]}