Detections
Analytics
CVE-2026-110923
medium
Description
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.
References
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101835
https://bugzilla.redhat.com/show_bug.cgi?id=2553028