CVE-2026-0964
libssh: Improper sanitation of paths received from SCP servers
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · February 11, 2026
Updated · September 1, 2026
Description
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Do not use SCP! SCP is deprecated for several years and will be removed in future releases!
If you have to, the application MUST validate the path returned
from ssh_scp_request_get_filename() is the path the application
requested. The libssh does not do any writing in this case.
CVSS / CWE
CVSS 3.0 · 5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')