CVE-2026-59995
ADVISORY - debianSummary
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
- openssh 1:10.4p1-1 [trixie] - openssh (Minor issue) [bookworm] - openssh (Minor issue) [bullseye] - openssh (Minor issue) https://www.openssh.org/releasenotes.html#10.4p1
EPSS Score: 0.00241 (0.152)
Common Weakness Enumeration (CWE)
ADVISORY - redhat
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2026-59995
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Debian
CREATED
UPDATED
ADVISORY IDCVE-2026-59995
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-59995
EXPLOITABILITY SCORE
2.8
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
5.4mediumRed Hat
CREATED
UPDATED
ADVISORY IDCVE-2026-59995
EXPLOITABILITY SCORE
2.8
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
5.4mediumPhoton
CREATED
UPDATED
ADVISORY ID
CVE-2026-59995
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-