CVE-2026-48711 Overview
CVE-2026-48711 is an argument injection vulnerability [CWE-88] in SSHFS, a FUSE-based network filesystem client for mounting remote directories over SSH. Versions from 1.4 up to (but not including) 3.7.6 accept bracketed mount sources such as [-oProxyCommand=CMD]:/path. The find_base_path() function strips the brackets and passes the resulting host string, which begins with -, directly to ssh as a command-line argument. When combined with a path-valued sftp_server configuration, ssh interprets the host as an option and executes an attacker-supplied ProxyCommand locally before authentication.
Critical Impact
Arbitrary command execution as the user invoking SSHFS when a caller passes an attacker-controlled mount source with the required sftp_server configuration.
Affected Products
- SSHFS versions 1.4 through 3.7.5
- Automount wrappers and orchestration tools that forward user-controlled mount sources to SSHFS
- Linux and Unix systems relying on libfuse SSHFS for remote filesystem mounts
Discovery Timeline
- 2026-08-19 - CVE-2026-48711 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-48711
Vulnerability Analysis
SSHFS parses mount source strings of the form host:/path to determine the remote target. To support IPv6 literals and similar constructs, the parser accepts a bracketed form such as [host]:/path. The find_base_path() routine removes the surrounding brackets without validating the enclosed content. An attacker who controls the mount source can supply [-oProxyCommand=arbitrary_cmd]:/path, and the resulting sshfs.host value retains the leading -.
SSHFS then invokes ssh with sshfs.host as a positional argument. Because the value begins with a dash, ssh treats it as an option (-oProxyCommand=...) rather than a hostname. The sftp_server configuration, when set to a path, occupies the position ssh would otherwise interpret as the destination host. The ProxyCommand option is evaluated by ssh before any network or authentication activity, so the injected shell command runs as the SSHFS user immediately.
Root Cause
The root cause is missing validation after bracket removal in find_base_path(). The function assumes bracketed content is a hostname or address literal and does not reject values beginning with -. Callers that forward untrusted mount sources to SSHFS therefore expose ssh's argument parser to injection.
Attack Vector
Exploitation requires local invocation of SSHFS with an attacker-controlled mount source and a sftp_server value set to a path. Automounters, GUI file managers, or scripted wrappers that accept remote paths from users or configuration files are the primary exposure surface. User interaction or a privileged wrapper is required, which is reflected in the local attack vector and high attack complexity.
// Patch in sshfs.c - reject hostnames beginning with '-'
*d++ = '\0';
s++;
+ if (sshfs.host[0] == '-') {
+ fprintf(stderr, "invalid hostname '%s'\n", sshfs.host);
+ exit(1);
+ }
+
return s;
}
Source: libfuse/sshfs commit 29bb565
Detection Methods for CVE-2026-48711
Indicators of Compromise
- Process execution of ssh with arguments beginning with -oProxyCommand= spawned as a child of sshfs
- Mount table or audit log entries containing bracketed mount sources with a leading - inside the brackets
- Unexpected child processes of the user running SSHFS (shells, network utilities) launched before any SSH authentication event
Detection Strategies
- Monitor execve events for sshfs invocations and inspect argv[1] for patterns matching \[-.*\]:
- Correlate sshfs process starts with immediate sh -c or arbitrary command child processes that precede any TCP connection to port 22
- Audit automounter configurations (autofs, systemd.automount, GVFS) for user-controllable remote path fields
Monitoring Recommendations
- Enable Linux auditd rules on mount and fusermount syscalls to capture mount source arguments
- Log SSHFS invocations centrally and alert on host arguments containing ProxyCommand, PermitLocalCommand, or -o
- Track SSHFS package versions across the fleet and flag any host running versions earlier than 3.7.6
How to Mitigate CVE-2026-48711
Immediate Actions Required
- Upgrade SSHFS to version 3.7.6 or later on all endpoints and servers
- Audit scripts, automounters, and GUI helpers that pass user-supplied strings to sshfs and reject values beginning with - or containing brackets
- Restrict which users and services can invoke sshfs, particularly through setuid wrappers or privileged automation
Patch Information
The fix is available in SSHFS release 3.7.6 and is tracked in GitHub Security Advisory GHSA-mm85-q63v-4476. The patch in commit 29bb565 rejects any hostname whose first character is - after bracket removal. See the corresponding pull request #362 for review discussion.
Workarounds
- Validate mount source strings in calling code and reject any input containing [, ], or a leading -
- Avoid configuring sftp_server to a path value in environments where mount sources may be attacker-influenced
- Run SSHFS under a low-privilege service account with restricted PATH and no interactive shells available
# Debian/Ubuntu: upgrade the sshfs package
sudo apt update && sudo apt install --only-upgrade sshfs
# Verify installed version is 3.7.6 or later
sshfs --version
# Example input validation in a wrapper script
case "$MOUNT_SRC" in
-*|\[-*) echo "invalid mount source"; exit 1 ;;
esac
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
