CVE-2026-59995: OpenSSH SFTP Path Traversal Vulnerability – Patch Guidance

Technical summary

CVE-2026-59995 is a path traversal flaw (CWE-23) in OpenSSH's SFTP client implementation. The vulnerability manifests when a user executes "sftp server:/path ." to recursively download files from a remote path to the current local directory. The SFTP client fails to properly validate and constrain the file paths returned by the server during the download operation. A malicious SFTP server can respond with specially crafted file paths containing directory traversal sequences (e.g., "../") or absolute paths, allowing files to be written to arbitrary locations on the client system outside the intended target directory. The vulnerability requires an attacker-controlled SFTP server and user interaction to execute the vulnerable download command, limiting its attack surface but creating risk in scenarios where users connect to untrusted or compromised servers.

Business impact

This vulnerability poses a moderate integrity risk to organizations where users regularly download files via SFTP from external or less-trusted sources. An attacker could overwrite critical system files, configuration files, or application binaries on a user's workstation, potentially leading to system compromise, application malfunction, or privilege escalation if the overwritten files are in privileged locations. The impact is mitigated by the requirement for user action and an attacker-controlled server, but organizations with developers, system administrators, or researchers who frequently use SFTP for data transfer face elevated risk. Compromised development environments could introduce supply chain risk if build artifacts or source code are modified.

Affected systems

OpenSSH versions prior to 10.4 running on any operating system where SFTP client functionality is used are affected. This includes Linux distributions, macOS, BSD systems, and Windows systems running OpenSSH (including Windows Subsystem for Linux and native Windows OpenSSH ports). Organizations should inventory systems running OpenSSH via package managers and verify the installed version. Note that the vulnerability is specific to the SFTP client component; SFTP server functionality and other SSH features are not affected.

Exploitability

Exploitability is constrained but present. An attacker must: (1) operate or compromise an SFTP server, (2) induce a user to connect and execute a recursive download command ("sftp server:/path ."), and (3) manipulate the server's responses to inject path traversal sequences. This is not a trivial attack chain, and the attack requires the user to explicitly initiate the download, making it unsuitable for mass exploitation. However, in targeted scenarios—such as social engineering a developer to download code from a malicious repository or compromising a legitimate server—the barrier is significantly lower. The CVSS score of 4.2 (MEDIUM) appropriately reflects the need for user interaction and attacker server control.

Remediation

Organizations should prioritize upgrading OpenSSH to version 10.4 or later on all systems where the SFTP client is used. Patching should be staged by system role and criticality: workstations used for software development and remote file transfer should be prioritized, followed by general user systems and servers. Verify patch deployment by confirming the version via "ssh -V" or package manager queries. Until patching is complete, users should avoid downloading files from untrusted SFTP sources and prefer alternative transfer methods (e.g., HTTPS, signed downloads) when interacting with external systems.

Patch guidance

Obtain OpenSSH 10.4 or later from the official OpenSSH project website or your operating system's package repository. For Linux distributions, use the native package manager (apt, yum, zypper, pacman, etc.) to upgrade openssh-client. macOS users should upgrade via Homebrew or MacPorts if installed, or via Apple's native updates if OpenSSH was installed through system updates. Windows Subsystem for Linux users should upgrade the Ubuntu or Debian package within their WSL instance. Verify successful patching by running "ssh -V" and confirming the version is 10.4 or later. Test SFTP functionality post-patching to ensure no regression in workflow. Organizations should verify against the official OpenSSH release notes and their vendor advisories to confirm patch applicability to their specific deployment.

Detection guidance

Monitor for exploitation attempts by logging SFTP client activity where possible. Check system logs for unexpected file creation or modification in directories outside user home directories following SFTP operations. File integrity monitoring tools can flag unauthorized changes to system files or critical application binaries. Network-level detection is limited due to SFTP's encrypted channel, but organizations can identify SFTP connections to non-standard or external servers via network flow logs. Consider deploying endpoint detection and response (EDR) solutions that monitor process execution and file system changes around SFTP operations. Retrospective log analysis should focus on SFTP client usage patterns and any correlations with system file modifications.

Why prioritize this

While the CVSS score of 4.2 is moderate, this vulnerability warrants timely but not emergency patching. The requirement for user interaction and attacker server control significantly limits exposure compared to remotely exploitable flaws. However, organizations with security-sensitive workstations—development environments, system administration machines, or researcher systems—should prioritize patching within 30 days, as these environments are both higher-value targets and more likely to interact with diverse SFTP sources. General user workstations can follow standard patching cycles but should not be deferred beyond 60 days given the integrity impact and relative ease of patching.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects: (1) network attack vector (AV:N)—the vulnerability requires connecting to an attacker-controlled or compromised SFTP server over the network; (2) high attack complexity (AC:H)—the attacker must operate a server and craft specific malicious responses, and the user must execute a particular command syntax; (3) no privileges required (PR:N)—an attacker does not need prior access to the client system; (4) required user interaction (UI:R)—the user must initiate the SFTP download; (5) unchanged scope (S:U)—the impact is confined to the affected user's local system; (6) no confidentiality impact (C:N)—data is not disclosed; and (7) low integrity and availability impact (I:L, A:L)—files can be overwritten or created in unintended locations, potentially affecting system operation. The moderate rating appropriately characterizes the real-world risk.

Frequently asked questions