← Back

CVE-2026-0964

nvd nist
Published: Mar 26, 2026Modified: Jun 17, 2026

JSON object

Loading...
6.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Exploitability: 2.8 / Impact: 3.4
Source: NVD

Description

A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

Affected (6)

Libssh
1 product
Libssh
Redhat
3 products
Enterprise Linux
Hardened Images
Openshift Container Platform
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Libssh
Before 0.11.4
Redhat
Enterprise Linux
Version 10.0
Enterprise Linux
Version 8.0
Enterprise Linux
Version 9.0
Hardened Images
All versions
Openshift Container Platform
Version 4.0

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (5)

Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
MitigationVendor Advisory
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: secalert@redhat.com
Release Notes

Timeline

No history available yet.