CVE-2026-0964
Path Traversal in SCP Client Allows Arbitrary File Overwrite
Publication date: 2026-03-26
Last updated on: 2026-04-30
Assigner: Red Hat, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | enterprise_linux | 8.0 |
| redhat | openshift_container_platform | 4.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
| redhat | hardened_images | * |
| libssh | libssh | to 0.11.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can allow a malicious SCP server to overwrite local files outside of the expected directory on your system.
An attacker could use this to create or modify malicious executable or configuration files on your client system.
Under specific conditions, this could lead to execution of harmful code, potentially compromising your system's security.
Can you explain this vulnerability to me?
CVE-2026-0964 is a security vulnerability in libssh related to improper sanitation of file paths received from SCP servers.
A malicious SCP server can send crafted paths that cause the libssh client to overwrite local files outside of its intended working directory.
This flaw can be exploited to create or modify malicious executable or configuration files on the client system, potentially leading to execution of harmful code under certain conditions.
It is analogous to the previously known OpenSSH vulnerability CVE-2019-6111.
What immediate steps should I take to mitigate this vulnerability?
This vulnerability arises from improper sanitation of file paths received from SCP servers in libssh clients, allowing malicious servers to overwrite local files outside the working directory.
To mitigate this vulnerability, you should update libssh to a version where this issue is fixed.
Additionally, avoid using SCP clients that rely on vulnerable versions of libssh when connecting to untrusted servers.