← All advisories

Medium severity4.2NVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026

CVE-2026-59995

CVE-2026-59995

Description

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

Affected products

6

OpenBSD/OpenSSHinferred2 versions
<10.4+ 1 more
- (no CPE)range: <10.4
- cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*range: <10.4
OpenSSH/OpenSSHllm-fuzzy
Range: <10.4
OpenSSH/sftpllm-fuzzy
Range: <10.4
osv-coords2 versions
pkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/openssh-askpass-gnome&distro=openSUSE%20Leap%2016.0
< 10.0p2-160000.7.1+ 1 more
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 10.0p2-160000.7.1

Patches

Vulnerability mechanics

References

3

marc.infonvdRelease Notes
www.openssh.org/releasenotes.htmlnvdRelease Notes
www.openwall.com/lists/oss-security/2026/07/06/5nvdMailing ListRelease Notes

News mentions

1

OpenSSH 10.4 Patches Six Vulnerabilities in Authentication and File Transfer Components
Vypr Intelligence · Jul 8, 2026