p PatchFirst

CVE-2026-59995

CVE-2026-59995

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

CVSS 4.2 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • openssh

    Versions
    • ≥ 0, < 10.4: Affected (custom)

    Update to 10.4

  • openssh Debian:12

    Versions
    • 1:10.0p1-1
    • 1:10.0p1-2
    • 1:10.0p1-3
    • 1:10.0p1-4
    • 1:10.0p1-5
    • 1:10.0p1-5~bpo12+2
    • 1:10.0p1-6
    • 1:10.0p1-7
    • 1:10.0p1-7~bpo12+1
    • 1:10.0p1-8
    • 1:10.1p1-1
    • 1:10.1p1-2
    • 1:10.2p1-1
    • 1:10.2p1-2
    • 1:10.2p1-2~bpo13+1
    • 1:10.2p1-3
    • 1:10.2p1-4
    • 1:10.2p1-5
    • 1:10.2p1-6
    • 1:10.2p1-6~bpo13+1
    • 1:10.3p1-1
    • 1:10.3p1-1~bpo13+1
    • 1:10.3p1-2
    • 1:10.3p1-3
    • 1:10.3p1-4
    • 1:10.3p1-5
    • 1:10.3p1-7
    • 1:10.3p1-8
    • 1:10.3p1-9
    • 1:10.4p1-1
    • 1:10.4p1-2
    • 1:10.4p1-3
    • 1:10.4p1-4
    • 1:10.4p1-5
    • 1:10.5p1-1
    • 1:9.2p1-2
    • 1:9.2p1-2+deb12u1
    • 1:9.2p1-2+deb12u10
    • 1:9.2p1-2+deb12u2
    • 1:9.2p1-2+deb12u3
    • 1:9.2p1-2+deb12u4
    • 1:9.2p1-2+deb12u5
    • 1:9.2p1-2+deb12u6
    • 1:9.2p1-2+deb12u7
    • 1:9.2p1-2+deb12u8
    • 1:9.2p1-2+deb12u9
    • 1:9.3p1-1
    • 1:9.3p1-1+loong64
    • 1:9.3p2-1
    • 1:9.4p1-1
    • 1:9.5p1-1
    • 1:9.5p1-2
    • 1:9.6p1-1
    • 1:9.6p1-2
    • 1:9.6p1-3
    • 1:9.6p1-4
    • 1:9.6p1-5
    • 1:9.7p1-1
    • 1:9.7p1-2
    • 1:9.7p1-3
    • 1:9.7p1-3+hurd.1
    • 1:9.7p1-4
    • 1:9.7p1-5
    • 1:9.7p1-6
    • 1:9.7p1-7
    • 1:9.8p1-1
    • 1:9.8p1-2
    • 1:9.8p1-3
    • 1:9.8p1-4
    • 1:9.8p1-7
    • 1:9.8p1-8
    • 1:9.9p1-1
    • 1:9.9p1-2
    • 1:9.9p1-3
    • 1:9.9p1-3+hurd.1
    • 1:9.9p2-1
    • 1:9.9p2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Debian:13

    Versions
    • 1:10.0p1-7
    • 1:10.0p1-7+deb13u1
    • 1:10.0p1-7+deb13u2
    • 1:10.0p1-7+deb13u3
    • 1:10.0p1-7+deb13u4
    • 1:10.0p1-8
    • 1:10.1p1-1
    • 1:10.1p1-2
    • 1:10.2p1-1
    • 1:10.2p1-2
    • 1:10.2p1-2~bpo13+1
    • 1:10.2p1-3
    • 1:10.2p1-4
    • 1:10.2p1-5
    • 1:10.2p1-6
    • 1:10.2p1-6~bpo13+1
    • 1:10.3p1-1
    • 1:10.3p1-1~bpo13+1
    • 1:10.3p1-2
    • 1:10.3p1-3
    • 1:10.3p1-4
    • 1:10.3p1-5
    • 1:10.3p1-7
    • 1:10.3p1-8
    • 1:10.3p1-9
    • 1:10.4p1-1
    • 1:10.4p1-2
    • 1:10.4p1-3
    • 1:10.4p1-4
    • 1:10.4p1-5
    • 1:10.5p1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Debian:14

    Versions
    • 1:10.0p1-7
    • 1:10.0p1-8
    • 1:10.1p1-1
    • 1:10.1p1-2
    • 1:10.2p1-1
    • 1:10.2p1-2
    • 1:10.2p1-2~bpo13+1
    • 1:10.2p1-3
    • 1:10.2p1-4
    • 1:10.2p1-5
    • 1:10.2p1-6
    • 1:10.2p1-6~bpo13+1
    • 1:10.3p1-1
    • 1:10.3p1-1~bpo13+1
    • 1:10.3p1-2
    • 1:10.3p1-3
    • 1:10.3p1-4
    • 1:10.3p1-5
    • 1:10.3p1-7
    • 1:10.3p1-8
    • 1:10.3p1-9
    Affected ranges
    • ECOSYSTEM: < 1:10.4p1-1

    Update to 1:10.4p1-1

  • openssh Ubuntu:Pro:14.04:LTS

    Versions
    • 1:6.2p2-6
    • 1:6.2p2-6ubuntu1
    • 1:6.4p1-1
    • 1:6.4p1-2
    • 1:6.5p1-1
    • 1:6.5p1-2
    • 1:6.5p1-3
    • 1:6.5p1-4
    • 1:6.5p1-6
    • 1:6.6p1-1
    • 1:6.6p1-2
    • 1:6.6p1-2ubuntu1
    • 1:6.6p1-2ubuntu2
    • 1:6.6p1-2ubuntu2.2
    • 1:6.6p1-2ubuntu2.3
    • 1:6.6p1-2ubuntu2.4
    • 1:6.6p1-2ubuntu2.6
    • 1:6.6p1-2ubuntu2.7
    • 1:6.6p1-2ubuntu2.8
    • 1:6.6p1-2ubuntu2.10
    • 1:6.6p1-2ubuntu2.11
    • 1:6.6p1-2ubuntu2.12
    • 1:6.6p1-2ubuntu2.13
    • 1:6.6p1-2ubuntu2.13+esm1
    • 1:6.6p1-2ubuntu2.13+esm2
    • 1:6.6p1-2ubuntu2.13+esm3
    Affected ranges
    • ECOSYSTEM: < 1:6.6p1-2ubuntu2.13+esm4

    Update to 1:6.6p1-2ubuntu2.13+esm4

  • openssh Ubuntu:Pro:16.04:LTS

    Versions
    • 1:6.9p1-2
    • 1:6.9p1-3
    • 1:7.1p1-1
    • 1:7.1p1-3
    • 1:7.1p1-4
    • 1:7.1p1-6
    • 1:7.1p2-1
    • 1:7.1p2-2
    • 1:7.2p1-1
    • 1:7.2p2-1
    • 1:7.2p2-2
    • 1:7.2p2-3
    • 1:7.2p2-4
    • 1:7.2p2-4ubuntu1
    • 1:7.2p2-4ubuntu2.1
    • 1:7.2p2-4ubuntu2.2
    • 1:7.2p2-4ubuntu2.4
    • 1:7.2p2-4ubuntu2.5
    • 1:7.2p2-4ubuntu2.6
    • 1:7.2p2-4ubuntu2.7
    • 1:7.2p2-4ubuntu2.8
    • 1:7.2p2-4ubuntu2.10
    • 1:7.2p2-4ubuntu2.10+esm1
    • 1:7.2p2-4ubuntu2.10+esm2
    • 1:7.2p2-4ubuntu2.10+esm3
    • 1:7.2p2-4ubuntu2.10+esm4
    • 1:7.2p2-4ubuntu2.10+esm5
    • 1:7.2p2-4ubuntu2.10+esm6
    • 1:7.2p2-4ubuntu2.10+esm7
    • 1:7.2p2-4ubuntu2.10+esm8
    • 1:7.2p2-4ubuntu2.10+esm9
    Affected ranges
    • ECOSYSTEM: < 1:7.2p2-4ubuntu2.10+esm10

    Update to 1:7.2p2-4ubuntu2.10+esm10

  • openssh Ubuntu:Pro:FIPS-updates:16.04:LTS

    Versions
    • 1:7.2p2-4ubuntu2.fips.2.2.3
    • 1:7.2p2-4ubuntu2.fips.2.4.1
    • 1:7.2p2-4ubuntu2.fips.2.4.2
    • 1:7.2p2-4ubuntu2.fips.2.8.1
    • 1:7.2p2-4ubuntu2.fips.2.10.1
    • 1:7.2p2-4ubuntu2.fips.2.10.2
    • 1:7.2p2-4ubuntu2.fips.2.10.3
    • 1:7.2p2-4ubuntu2.fips.2.10.4
    • 1:7.2p2-4ubuntu2.fips.2.10.5
    • 1:7.2p2-4ubuntu2.fips.2.10.6
    • 1:7.2p2-4ubuntu2.fips.2.10.7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS:16.04:LTS

    Versions
    • 1:7.2p2-4ubuntu2.fips.2.2
    • 1:7.2p2-4ubuntu2.fips.2.2.1
    • 1:7.2p2-4ubuntu2.fips.2.10.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:18.04:LTS

    Versions
    • 1:7.5p1-10
    • 1:7.6p1-4
    • 1:7.6p1-4ubuntu0.1
    • 1:7.6p1-4ubuntu0.2
    • 1:7.6p1-4ubuntu0.3
    • 1:7.6p1-4ubuntu0.5
    • 1:7.6p1-4ubuntu0.6
    • 1:7.6p1-4ubuntu0.7
    • 1:7.6p1-4ubuntu0.7+esm1
    • 1:7.6p1-4ubuntu0.7+esm2
    • 1:7.6p1-4ubuntu0.7+esm3
    • 1:7.6p1-4ubuntu0.7+esm4
    • 1:7.6p1-4ubuntu0.7+esm5
    Affected ranges
    • ECOSYSTEM: < 1:7.6p1-4ubuntu0.7+esm6

    Update to 1:7.6p1-4ubuntu0.7+esm6

  • openssh-ssh1 Ubuntu:18.04:LTS

    Versions
    • 1:7.5p1-8
    • 1:7.5p1-9
    • 1:7.5p1-9build1
    • 1:7.5p1-10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-updates:18.04:LTS

    Versions
    • 1:7.9p1-10~ubuntu18.04.fips.0.1
    • 1:7.9p1-10~ubuntu18.04.fips.0.2
    • 1:7.9p1-10~ubuntu18.04.fips.0.3
    • 1:7.9p1-10~ubuntu18.04.fips.0.4
    • 1:7.9p1-10~ubuntu18.04.fips.0.5
    • 1:7.9p1-10~ubuntu18.04.fips.0.6
    • 1:7.9p1-10~ubuntu18.04.fips.0.7
    • 1:7.9p1-10~ubuntu18.04.fips.0.8
    • 1:7.9p1-10~ubuntu18.04.fips.0.9
    • 1:7.9p1-10~ubuntu18.04.fips.0.10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS:18.04:LTS

    Versions
    • 1:7.9p1-10~ubuntu18.04.fips.0.1
    • 1:7.9p1-10~ubuntu18.04.fips.0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:20.04:LTS

    Versions
    • 1:8.0p1-6build1
    • 1:8.1p1-1
    • 1:8.1p1-5
    • 1:8.2p1-4
    • 1:8.2p1-4ubuntu0.1
    • 1:8.2p1-4ubuntu0.2
    • 1:8.2p1-4ubuntu0.3
    • 1:8.2p1-4ubuntu0.4
    • 1:8.2p1-4ubuntu0.5
    • 1:8.2p1-4ubuntu0.7
    • 1:8.2p1-4ubuntu0.8
    • 1:8.2p1-4ubuntu0.9
    • 1:8.2p1-4ubuntu0.10
    • 1:8.2p1-4ubuntu0.11
    • 1:8.2p1-4ubuntu0.12
    • 1:8.2p1-4ubuntu0.13
    • 1:8.2p1-4ubuntu0.13+esm1
    • 1:8.2p1-4ubuntu0.13+esm2
    Affected ranges
    • ECOSYSTEM: < 1:8.2p1-4ubuntu0.13+esm3

    Update to 1:8.2p1-4ubuntu0.13+esm3

  • openssh-ssh1 Ubuntu:20.04:LTS

    Versions
    • 1:7.5p1-11build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-updates:20.04:LTS

    Versions
    • 1:8.2p1-4ubuntu0.fips.0.2.1
    • 1:8.2p1-4ubuntu0.fips.0.4.0
    • 1:8.2p1-4ubuntu0.fips.0.5.0
    • 1:8.2p1-4ubuntu0.fips.0.7
    • 1:8.2p1-4ubuntu0.fips.0.8
    • 1:8.2p1-4ubuntu0.fips.0.9
    • 1:8.2p1-4ubuntu0.fips.0.10
    • 1:8.2p1-4ubuntu0.fips.0.11
    • 1:8.2p1-4ubuntu0.fips.0.12
    • 1:8.2p1-4ubuntu0.fips.0.13
    • 1:8.2p1-4ubuntu0.fips.0.13.1
    • 1:8.2p1-4ubuntu0.fips.0.13.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS:20.04:LTS

    Versions
    • 1:8.2p1-4ubuntu0.fips.0.2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:22.04:LTS

    Versions
    • 1:8.4p1-6ubuntu2
    • 1:8.7p1-2
    • 1:8.7p1-2build1
    • 1:8.7p1-4
    • 1:8.8p1-1
    • 1:8.9p1-3
    • 1:8.9p1-3ubuntu0.1
    • 1:8.9p1-3ubuntu0.3
    • 1:8.9p1-3ubuntu0.4
    • 1:8.9p1-3ubuntu0.5
    • 1:8.9p1-3ubuntu0.6
    • 1:8.9p1-3ubuntu0.7
    • 1:8.9p1-3ubuntu0.10
    • 1:8.9p1-3ubuntu0.11
    • 1:8.9p1-3ubuntu0.13
    • 1:8.9p1-3ubuntu0.14
    • 1:8.9p1-3ubuntu0.15
    Affected ranges
    • ECOSYSTEM: < 1:8.9p1-3ubuntu0.16

    Update to 1:8.9p1-3ubuntu0.16

  • openssh-ssh1 Ubuntu:22.04:LTS

    Versions
    • 1:7.5p1-12
    • 1:7.5p1-12build1
    • 1:7.5p1-13
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-preview:22.04:LTS

    Versions
    • 1:8.9p1-3ubuntu0.4+Fips1
    • 1:8.9p1-3ubuntu0.4+Fips3
    • 1:8.9p1-3ubuntu1.fips.0~ppa3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-updates:22.04:LTS

    Versions
    • 1:8.9p1-3ubuntu0.4+Fips1
    • 1:8.9p1-3ubuntu0.4+Fips3
    • 1:8.9p1-3ubuntu0.6+Fips1
    • 1:8.9p1-3ubuntu0.7+Fips1
    • 1:8.9p1-3ubuntu0.10+Fips1
    • 1:8.9p1-3ubuntu0.11+Fips1
    • 1:8.9p1-3ubuntu0.13+Fips1
    • 1:8.9p1-3ubuntu0.14+Fips1
    • 1:8.9p1-3ubuntu0.15+Fips1
    • 1:8.9p1-3ubuntu0.15+Fips3
    Affected ranges
    • ECOSYSTEM: < 1:8.9p1-3ubuntu0.16+Fips3

    Update to 1:8.9p1-3ubuntu0.16+Fips3

  • openssh Ubuntu:24.04:LTS

    Versions
    • 1:9.3p1-1ubuntu3
    • 1:9.4p1-1ubuntu1
    • 1:9.6p1-3ubuntu1
    • 1:9.6p1-3ubuntu2
    • 1:9.6p1-3ubuntu11
    • 1:9.6p1-3ubuntu12
    • 1:9.6p1-3ubuntu13
    • 1:9.6p1-3ubuntu13.3
    • 1:9.6p1-3ubuntu13.4
    • 1:9.6p1-3ubuntu13.5
    • 1:9.6p1-3ubuntu13.7
    • 1:9.6p1-3ubuntu13.8
    • 1:9.6p1-3ubuntu13.9
    • 1:9.6p1-3ubuntu13.11
    • 1:9.6p1-3ubuntu13.12
    • 1:9.6p1-3ubuntu13.13
    • 1:9.6p1-3ubuntu13.14
    • 1:9.6p1-3ubuntu13.15
    • 1:9.6p1-3ubuntu13.16
    Affected ranges
    • ECOSYSTEM: < 1:9.6p1-3ubuntu13.18

    Update to 1:9.6p1-3ubuntu13.18

  • openssh-ssh1 Ubuntu:24.04:LTS

    Versions
    • 1:7.5p1-14
    • 1:7.5p1-15
    • 1:7.5p1-15build1
    • 1:7.5p1-16
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh Ubuntu:Pro:FIPS-updates:24.04:LTS

    Versions
    • 1:9.6p1-3ubuntu13.7+Fips1
    • 1:9.6p1-3ubuntu13.12+Fips1
    • 1:9.6p1-3ubuntu13.13+Fips1
    • 1:9.6p1-3ubuntu13.14+Fips1
    • 1:9.6p1-3ubuntu13.15+Fips1
    • 1:9.6p1-3ubuntu13.16+Fips1
    • 1:9.6p1-3ubuntu13.16+Fips2
    Affected ranges
    • ECOSYSTEM: < 1:9.6p1-3ubuntu13.18+Fips1

    Update to 1:9.6p1-3ubuntu13.18+Fips1

  • openssh Ubuntu:25.10

    Versions
    • 1:9.9p1-3ubuntu3
    • 1:9.9p1-3ubuntu3.1
    • 1:10.0p1-5ubuntu2
    • 1:10.0p1-5ubuntu3
    • 1:10.0p1-5ubuntu4
    • 1:10.0p1-5ubuntu5
    • 1:10.0p1-5ubuntu5.1
    • 1:10.0p1-5ubuntu5.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →