CVEvulnerability

CVE-2026-0964

6.3 MEDIUM Published 2026-03-26 Modified 2026-09-01 Official page ↗
Status
Modified
Published
2026-03-26
Last modified
2026-09-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.0 ([email protected])
5.0 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-22

Description

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

Affected configurations

• libssh libssh (< 0.11.4) • redhat hardened images • redhat openshift container platform 4.0 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • redhat enterprise linux 10.0

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References