CVE-2026-59995

ADVISORY - debian

Summary

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

openssh 1:10.4p1-1 [trixie] - openssh (Minor issue) [bookworm] - openssh (Minor issue) [bullseye] - openssh (Minor issue) https://www.openssh.org/releasenotes.html#10.4p1

EPSS Score⁠: 0.0025 (0.167)

Common Weakness Enumeration (CWE)

ADVISORY - redhat

CWE-22⁠

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.