Medium severity4.2NVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026
CVE-2026-59995
CVE-2026-59995
Description
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
Affected products
15- osv-coords11 versionspkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/openssh-cavspkg:rpm/almalinux/openssh-askpasspkg:rpm/almalinux/openssh-keysignpkg:rpm/almalinux/opensshpkg:rpm/almalinux/openssh-serverpkg:rpm/almalinux/openssh-clientspkg:rpm/almalinux/pam_ssh_agent_authpkg:rpm/opensuse/openssh-askpass-gnome&distro=openSUSE%20Leap%2016.0pkg:rpm/almalinux/openssh-keycatpkg:rpm/almalinux/openssh-ldap
< 10.0p2-160000.7.1+ 10 more
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 8.0p1-33.el8_10
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 0.10.4-8.11.el9_8.alma.1
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 9.9p1-27.el10_2.alma.1
- (no CPE)range: < 8.0p1-33.el8_10
Patches
Vulnerability mechanics
References
3- marc.infonvdRelease Notes
- www.openssh.org/releasenotes.htmlnvdRelease Notes
- www.openwall.com/lists/oss-security/2026/07/06/5nvdMailing ListRelease Notes
News mentions
1- OpenSSH 10.4 Patches Six Vulnerabilities in Authentication and File Transfer ComponentsVypr Intelligence · Jul 8, 2026