Medium severity6.5NVD Advisory· Published Oct 15, 2026
CVE-2026-110923
CVE-2026-110923
Description
A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.