Medium severity4.2NVD Advisory· Published Jul 8, 2026· Updated Jul 9, 2026

CVE-2026-59996

Description

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

OpenBSD/OpenSSHinferred2 versions
<10.4+ 1 more
- (no CPE)range: <10.4
- cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*range: <10.4
OpenSSH/OpenSSHllm-fuzzy
Range: <10.4
OpenSSH/scpllm-fuzzy
Range: <10.4
osv-coords9 versions
pkg:rpm/almalinux/openssh pkg:rpm/almalinux/openssh-askpass pkg:rpm/almalinux/openssh-clients pkg:rpm/almalinux/openssh-keycat pkg:rpm/almalinux/openssh-keysign pkg:rpm/almalinux/openssh-server pkg:rpm/almalinux/pam_ssh_agent_auth pkg:rpm/opensuse/openssh&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/openssh-askpass-gnome&distro=openSUSE%20Leap%2016.0
< 9.9p1-9.el9_8.alma.1+ 8 more
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 9.9p1-25.el10_2.alma.1
- (no CPE)range: < 9.9p1-9.el9_8.alma.1
- (no CPE)range: < 0.10.4-7.9.el9_8.alma.1
- (no CPE)range: < 10.0p2-160000.7.1
- (no CPE)range: < 10.0p2-160000.7.1