CVE-2026-59996
Received Received - Intake

scp Path Traversal in OpenSSH

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: MITRE

Description
scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-08
Generated
2026-07-08
AI Q&A
2026-07-08
EPSS Evaluated
N/A
NVD
CVE-2026-59996
EUVD
EUVD-2026-42138

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openssh scp to 10.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the scp command of OpenSSH versions before 10.4. When copying files between two remote destinations, scp may incorrectly place a file in the parent directory of the intended target directory instead of the correct location.

Impact Analysis

The vulnerability can lead to files being placed in unintended directories, which may cause data to be stored in incorrect locations. This could result in unauthorized access to files, data leakage, or disruption of file organization and system operations.

Compliance Impact

The provided information does not specify how the vulnerability in OpenSSH scp before version 10.4 affects compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OpenSSH to version 10.4 or later, as this release includes fixes for the scp vulnerability that could allow files to be placed in unintended directories.

The update also contains other security improvements and bug fixes, so applying the latest OpenSSH release is the recommended immediate step.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart