CVE-2026-59996: OpenSSH SCP Path Traversal Vulnerability

CVE-2026-59996 Overview

CVE-2026-59996 is a path traversal vulnerability in the scp utility shipped with OpenSSH versions prior to 10.4. When scp copies files between two remote destinations, it may place a file in the parent directory of the intended target directory instead of the directory the user specified. The flaw is categorized under CWE-23: Relative Path Traversal and affects the remote-to-remote copy mode of scp. OpenSSH 10.4p1 addresses the issue.

Critical Impact
Files transferred between two remote hosts via scp can land outside the intended destination directory, allowing an attacker who controls one side of the transfer to write files into an adjacent path.

Affected Products

OpenSSH versions prior to 10.4 (scp utility)
OpenSSH portable releases prior to 10.4p1
Systems using OpenSSH scp for remote-to-remote copy operations

Discovery Timeline

2026-07-08 - CVE-2026-59996 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59996

Vulnerability Analysis

The vulnerability affects the scp client when invoked in remote-to-remote mode, where the local host orchestrates a copy between two remote systems. In this mode, the destination path resolution does not sufficiently constrain filenames returned by the source host. As a result, scp can write the transferred file one directory level above the intended target. The issue is tracked as a relative path traversal weakness [CWE-23].

Successful exploitation requires user interaction, specifically the invocation of an scp transfer between two remote endpoints. The attacker must also influence the source-side filename or metadata to trigger the traversal, which contributes to the higher attack complexity.

Root Cause

The root cause lies in scp's handling of destination path construction during remote-to-remote copies. The utility trusts filename components in a way that permits relative traversal sequences to escape the intended target directory. OpenSSH 10.4p1 tightens this path handling. See the OpenSSH Release Notes 10.4p1 and the Openwall OSS-Security Mailing List Post for the upstream discussion.

Attack Vector

An attacker who controls the source host in a remote-to-remote scp transfer can craft filename responses that cause the receiving endpoint to write the file into the parent of the requested directory. The attack requires the victim user to initiate the copy operation. Impact is limited to file placement outside the intended directory, which can result in low-level integrity and availability effects but does not directly disclose confidential data. Refer to the OpenSSH Development Discussion for technical background.

No public exploit code is currently available for CVE-2026-59996, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-59996

Indicators of Compromise

Files appearing in parent directories of expected scp destinations without corresponding user action
scp transfer logs referencing remote-to-remote copies (scp host1:path host2:path) followed by unexpected file placements
Audit records showing writes to paths one level above the specified target directory during scp sessions

Detection Strategies

Inventory installed OpenSSH versions across the fleet and flag any release earlier than 10.4 or 10.4p1
Monitor process execution for scp invocations that specify two remote endpoints, which is the vulnerable code path
Correlate filesystem creation events with concurrent sshd sessions to identify files written outside intended directories

Monitoring Recommendations

Enable sshd verbose logging and forward events to a centralized log platform for path-anomaly detection
Track file integrity in directories adjacent to common scp destinations, such as user home directories and shared upload paths
Alert on unexpected write operations by sshd child processes to parent directories of documented transfer targets

How to Mitigate CVE-2026-59996

Immediate Actions Required

Upgrade OpenSSH to version 10.4 or later (10.4p1 for portable builds) on all systems where scp is used
Identify automation and scripts that invoke scp in remote-to-remote mode and review them for exposure
Prefer sftp or rsync over ssh for scripted remote-to-remote transfers until patching is complete

Patch Information

OpenSSH 10.4p1 fixes the vulnerable path handling in scp. Download the updated release from the OpenSSH Release Notes 10.4p1 and apply distribution-provided packages once vendors publish backported updates.

Workarounds

Avoid the remote-to-remote scp mode; stage transfers by first copying to the local host, then to the destination
Replace scp with sftp, which uses a different protocol path and is not affected by this specific issue
Restrict scp usage to trusted source hosts only, since exploitation requires attacker influence over the source side

bash

# Verify the installed OpenSSH version
ssh -V

# Example: replace remote-to-remote scp with a two-step local stage
scp user@source:/path/to/file /tmp/staging/
scp /tmp/staging/file user@dest:/intended/directory/