CVE-2026-47187
Received Received - Intake

SSHFS Path Traversal via Malicious SFTP Symlinks

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform_symlink() returns early at sshfs.c:2181, while sshfs_readlink() at sshfs.c:2234 to sshfs.c:2236 otherwise copies the server-supplied link target to the kernel. A victim or victim-side tool that follows such a link through ordinary operations such as cp, rsync, backup tooling, or an editor can disclose readable local files back to the server or write server-controlled content to writable local files, potentially including startup or scheduled-task files. This issue is fixed in version 3.7.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-47187
EUVD
EUVD-2026-62493

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libfuse sshfs to 3.7.6 (exc)
libfuse sshfs 3.7.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47187 is a critical vulnerability in sshfs versions 3.7.5 and earlier. A rogue SFTP server can manipulate symlink targets to perform unauthorized local file read or write operations on the client's system. The issue occurs because sshfs passes server-supplied symlink targets directly to the kernel, which resolves them on the local filesystem. Attackers can exploit this to either read sensitive files or overwrite critical files like startup scripts.

Detection Guidance

Check sshfs version with 'sshfs -V'. If it is 3.7.5 or earlier, the system is vulnerable. Inspect mounted directories for unexpected symlinks or file operations that follow server-controlled paths.

Impact Analysis

If you use sshfs to connect to an untrusted SFTP server, an attacker controlling that server could read files from your local system or overwrite important files. This could lead to data theft, system compromise, or malware execution if the attacker replaces legitimate files with malicious ones.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using sshfs with untrusted servers may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade sshfs to version 3.7.6 or later. If upgrading is not possible, enable the contain_symlinks option by default or avoid using untrusted SFTP servers. Do not disable contain_symlinks unless absolutely necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart