CVE-2026-0964

Summary

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences.

This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 100:0.12.0-2.el10 < *unaffected
Red HatRed Hat Enterprise Linux 90:0.10.4-18.el9 < *unaffected
Red HatRed Hat Enterprise Linux 90:0.10.4-18.el9 < *unaffected

Weaknesses

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Workarounds

Do not use SCP! SCP is deprecated for several years and will be removed in future releases!

If you have to, the application MUST validate the path returned from ssh_scp_request_get_filename() is the path the application requested. The libssh does not do any writing in this case.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References