CVE-2026-59995: Relative Path Traversal in OpenSSH sftp Client

The client-side sftp(1) tool provided by OpenSSH is widely utilized for secure file transfers over SSH. In configurations where a user invokes a direct, one-shot download command utilizing the specific syntax sftp server:/path ., the sftp client establishes a connection to the specified remote server, retrieves target files, and writes them locally. This operation creates an implicit trust relationship regarding the filenames returned by the remote entity.

Historically, the client application failed to adequately validate and sanitize file paths returned by remote endpoints. If an attacker controls or compromises the target SFTP server, they can manipulate the SFTP protocol responses to dictate exactly where the files are written on the local client host. This vulnerability belongs to the Relative Path Traversal class (CWE-23).

The vulnerability is constrained primarily by the privileges of the local user running the sftp command. Because the issue occurs within the client-side filename parser, standard server-side configurations do not mitigate the flaw. Users utilizing interactive SFTP sessions or automated scripts targeting unvetted remote hosts are particularly exposed.

During a typical SFTP session, name resolution and directory listings are handled via protocol-specific packets. When the client executes a one-shot transfer command, it sends a request for the remote file path. The server processes this request and responds with file attributes and filenames using SSH2_FXP_NAME packets. These packets contain the metadata that the client uses to write files to the local disk.

The critical bug resides in how the sftp(1) client processes the filenames extracted from these packets. The client constructs the target write path by appending the remote-provided filename to the user-supplied local target directory, which is typically the current working directory (.). Before the release of OpenSSH 10.4, the client failed to sanitize relative directory traversal components (such as ../) present within the filenames returned by the server.

Consequently, the local destination path is calculated using simple string concatenation without canonicalization checks. If the server returns a filename structured as ../../.ssh/authorized_keys, the client resolves the local path to ./../../.ssh/authorized_keys. This calculation forces the file creation routine to traverse outside of the intended target directory and write to arbitrary locations within the boundaries of the executing user's filesystem permissions.

A review of the vulnerable path-generation logic indicates that the sftp client handled remote filename parsing directly within the remote file download loops. Below is a structural representation of the vulnerable filename handling logic compared to the hardened validation implemented in version 10.4.

// Vulnerable logic pattern in sftp-client.c before OpenSSH 10.4
char *local_path;
char *remote_filename = get_filename_from_packet(payload);
 
// Naive concatenation of the local destination and the remote filename
local_path = path_append(destination_directory, remote_filename);
 
// Opens the file path directly, traversing parent directories if present in remote_filename
int file_descriptor = open(local_path, O_WRONLY | O_CREAT | O_TRUNC, 0600);

To correct this security flaw, OpenSSH 10.4 introduced a path sanitization routine. This routine strips relative path sequences and prevents the local sftp client from executing path operations outside the designated root directory of the download request. If directory traversal sequences are identified, the operation is rejected before file descriptors are opened.

// Hardened validation pattern in sftp-client.c in OpenSSH 10.4
char *local_path;
char *remote_filename = get_filename_from_packet(payload);
 
// New verification step to prevent path traversal
if (has_directory_traversal(remote_filename)) {
    fatal("Security violation: remote server returned invalid filename '%s'", remote_filename);
    cleanup_and_exit(1);
}
 
// Safely concatenate after validation passes
local_path = path_append(destination_directory, remote_filename);

The fix is robust because it prevents the path resolution mechanism from executing if any path component attempts to go up the directory tree relative to the target location. This completely eliminates the threat vectors utilizing relative directory sequences via SFTP client downloads.

Exploiting CVE-2026-59995 requires a specific sequence of actions and conditions. First, the attacker must configure or compromise an SFTP server to serve modified file metadata. Standard SFTP daemons will not perform path traversal attacks of this nature; therefore, a custom or patched daemon is necessary to inject traversal payloads inside the SSH2_FXP_NAME protocol packets.

Next, the attacker must entice a target user into initiating a file transfer utilizing the one-shot syntax. This is typically achieved via social engineering, phishing, or modified documentation guides directing the victim to run a command such as:

sftp attacker-controlled-server:/files/manual.pdf .

When the victim executes this command, the rogue server responds with the file payload but specifies the filename as ../../.bashrc or ../../.ssh/authorized_keys. The vulnerable sftp client translates this path relative to the active target directory (.), executing the write outside the expected parameters. If the command is executed within a user's home directory, files such as shell profile configurations can be overwritten, leading to persistent code execution upon subsequent shell interactive logins.

The National Vulnerability Database evaluates this vulnerability with a CVSS 3.1 base score of 4.2 (Medium). This severity rating represents the combination of a remote attack vector with a high attack complexity and mandatory user interaction. The scope of the vulnerability is unchanged because the impact does not cross to separate virtualized security boundaries beyond the local system execution layer.

The integrity impact is assessed as low because file creation and manipulation are strictly bounded by the filesystem permissions of the local user running the sftp command. An attacker cannot overwrite root-level configuration files (such as /etc/passwd or /etc/shadow) unless the victim executes the vulnerable client session with superuser privileges.

However, in typical developer and administrator environments, local user privileges are sufficient to achieve persistence. Overwriting user-level startup scripts (.profile, .bashrc) or appending keys to .ssh/authorized_keys allows complete user-level compromise. The EPSS score currently sits at 0.0025, which reflects a low current threat profile in the wild, and the vulnerability is not currently tracked on the CISA KEV list.

The primary remediation strategy is upgrading the client-side OpenSSH suite to version 10.4 or higher. Operating system packages should be updated using local package distribution managers to ensure the binary is patched.

For systems where immediate upgrades are not possible, several configuration-based and operational workarounds can minimize the exposure surface. Users must refrain from utilizing the command-line format that maps remote files directly to the current directory (sftp server:file .). Instead, interactive sftp shell sessions should be used, where the target location is verified or controlled through specific interactive subcommands.

Additionally, automate SFTP workflows inside isolated directories that do not contain sensitive system configuration files. Restricting outbound SSH/SFTP access at the host firewall layer can ensure that client systems only initiate transfer sessions with trusted corporate servers, effectively blocking attempts to connect with untrusted, malicious remote infrastructure.