CVE-2026-110923
Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in OpenSSH sftp Client

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: redhat-SADP

Description
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-110923
EUVD
EUVD-2026-101835

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Red Hat Red Hat Enterprise Linux 10 *
Red Hat Red Hat Enterprise Linux 6 *
Red Hat Red Hat Enterprise Linux 7 *
Red Hat Red Hat Enterprise Linux 8 *
Red Hat Red Hat Enterprise Linux 9 *
Red Hat Red Hat Hardened Images *
Red Hat Red Hat OpenShift Container Platform 4 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in OpenSSH's SFTP component. A malicious SFTP server can manipulate the local destination path during file copy operations by supplying an empty name, a slash-only path, or a '..' basename. This causes files to be written outside the directory the user intended to use.

Detection Guidance

To detect this vulnerability, monitor SFTP operations for unusual file writes outside intended directories. Check system logs for sftp-server or sshd processes handling suspicious paths. Review user home directories and system-wide directories for unexpected files created by SFTP sessions.

Impact Analysis

The impact depends on your use of SFTP. If you copy files from untrusted SFTP servers, an attacker could write files to unintended locations on your system. These files would have the same permissions as your user account, potentially leading to unauthorized file creation or modification.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized file writes outside intended directories during SFTP operations. Unauthorized file modifications may lead to data integrity issues, unauthorized access to sensitive data, or improper data handling, which are key concerns under these regulations.

Mitigation Strategies

Avoid using SFTP to copy files from untrusted servers. If SFTP is required, ensure servers are trusted and paths are validated. Consider using alternative secure file transfer methods. Apply vendor patches when available for OpenSSH or affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart