Debian Linux - sshfs-fuse - None

Ubuntu Linux - [Unknown description]

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20915-1 advisory.

    Changes in sshfs:

    - Update to 3.7.6:
      - Added new maintainer: abhinavagarwal07 Abhinav Agarwal
      - CVE-2026-47187: Fixed critical vulnerability - Symlink         Escape: Rogue SFTP Server to Local File Read/Write), credit         to abhinavagarwal07 (bsc#1267017)
      - New -o contain_symlinks and -o no_contain_symlinks to control         symlink containment behavior
      - CVE-2026-48711: Fixed high severity vulnerability - Improper         Neutralization of Argument Delimiters in a Command ('Argument         Injection'), credit to abhinavagarwal07 (bsc#1267016)
      - Fixed null-deref warning in tokenize_on_space, promote         strict-warnings to required
      - Added a number of tests in CI, including rename, chmod,         fsync, statvfs values, error paths, option coverage
      - Fixed malformed SFTP reply handling

    - Update to 3.7.5:
      * Implement connect to vsock
      * use latest major version for actions/checkout
      * Fix memleak in cache after readlink
      * Fill stat info when returning cached data for readdir
      * ipv6 support for directport connection
    - reverts to original fork

    - Don't globstar files in shared directory _bindir.

    - build the man page

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  CVE-2026-47187, CVE-2026-48711


The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - sshfs-fuse - None  Ubuntu Linux - [Unknown description] (CVE-2026-48711)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
320416	openSUSE 16 Security Update : sshfs (openSUSE-SU-2026:20915-1)	Nessus	SuSE Local Security Checks	critical
442733	Alpine: multiple sshfs packages: security update to 3.7.6-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
442733	Alpine: multiple sshfs packages: security update to 3.7.6-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
318049	Linux Distros Unpatched Vulnerability : CVE-2026-48711	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-48711

critical

Tenable Plugins

critical

critical

critical

critical