CVE-2026-59995: OpenSSH SFTP Path Traversal Vulnerability

CVE-2026-59995 Overview

CVE-2026-59995 affects the sftp client in OpenSSH versions prior to 10.4. The client fails to constrain the location of downloaded files when a user runs a command such as sftp server:/path . against an attacker-controlled server. A malicious server can respond with filenames that cause the client to write files outside the intended local destination directory. The flaw is classified as a relative path traversal issue [CWE-23] and was addressed in OpenSSH 10.4p1.

Critical Impact
A malicious or compromised SFTP server can write attacker-chosen files to unintended locations on a connecting client's filesystem, enabling limited integrity and availability impact.

Affected Products

OpenSSH sftp client versions before 10.4
Operating system distributions bundling OpenSSH prior to 10.4p1
Automation and CI/CD pipelines invoking sftp against third-party servers

Discovery Timeline

2026-07-08 - CVE-2026-59995 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59995

Vulnerability Analysis

The sftp client in OpenSSH before 10.4 trusts filename metadata returned by the remote server when performing a directory download. When a user executes sftp server:/path ., the client iterates over the server-supplied file listing and writes each entry to the local working directory. The client does not sufficiently validate that returned filenames are simple basenames confined to the destination directory. An attacker who controls the server, or who has compromised a legitimate server, can return crafted names containing path separators or relative traversal sequences. The client then writes those files to arbitrary locations reachable from the invoking user's privileges.

Root Cause

The root cause is improper constraint of a pathname to a restricted directory, tracked as [CWE-23]. The client-side path assembly logic accepts server-provided names without stripping directory components or rejecting traversal sequences before opening the local output file. Successful exploitation requires user interaction and a non-trivial attack scenario in which the client connects to a hostile server.

Attack Vector

Exploitation requires the victim to initiate an SFTP download from an attacker-controlled server. The server responds to directory read operations with entries whose names manipulate the client's local write path. Because the write occurs under the invoking user's context, an attacker can drop files into locations such as configuration or startup directories writable by that user. The vulnerability does not enable code execution directly. See the OpenSSH Release Notes 10.4p1 and the Openwall OSS Security Discussion for protocol-level details.

Detection Methods for CVE-2026-59995

Indicators of Compromise

Unexpected files appearing outside the local destination directory after an sftp download session
Modifications to user-writable configuration files such as ~/.bashrc, ~/.ssh/authorized_keys, or ~/.config/* shortly after an SFTP session
SFTP client logs showing directory downloads from untrusted or newly introduced remote hosts

Detection Strategies

Audit endpoint file creation events correlated with sftp process execution to flag writes outside the invoking working directory
Inspect shell history and CI/CD job logs for sftp server:/path . style invocations against non-corporate hosts
Compare OpenSSH client version strings across the fleet to identify hosts running versions earlier than 10.4p1

Monitoring Recommendations

Enable process and file telemetry for sftp invocations, capturing parent process, remote host, and files written
Alert on SFTP client processes writing to sensitive paths such as ~/.ssh/, /etc/, or user autostart directories
Track outbound SFTP connections to hosts outside an approved allowlist

How to Mitigate CVE-2026-59995

Immediate Actions Required

Upgrade OpenSSH client packages to 10.4p1 or later on all workstations, servers, and build agents
Restrict interactive and automated sftp usage to servers under organizational control or on an explicit allowlist
Review recent SFTP sessions with third-party hosts and validate that no unexpected files were written outside the intended directory

Patch Information

OpenSSH 10.4p1 addresses this issue by constraining downloaded file locations to the requested destination directory. Refer to the OpenSSH Release Notes 10.4p1 and the OpenSSH Development Mailing List for the upstream fix. Distribution maintainers have issued backported packages; apply vendor updates through the standard package manager.

Workarounds

Avoid running sftp server:/path . against untrusted servers until the client is patched
Use scp with explicit filenames or rsync over SSH with strict path handling as interim alternatives where feasible
Execute SFTP downloads inside a dedicated, empty working directory to limit the blast radius of unexpected file writes

bash

# Verify installed OpenSSH client version
ssh -V

# Debian/Ubuntu: update to a fixed package
sudo apt update && sudo apt install --only-upgrade openssh-client

# RHEL/Fedora: update to a fixed package
sudo dnf update openssh-clients